13

A drone intrusion prevention product being advertised at RSA Conference this year has piqued my interest, and I'm trying to determine whether it and other drone IPS systems are illegal.

For background, a WIPS is a device which looks for unexpected WiFi access points nearby and purposefully sends de-authentication packets in order to prevent them from working. In August 2015 the FCC ruled that doing this to hotel guests was illegal, citing Section 333 of the Communications Act 1934. This appears to tally with the FCC's guidance. However, it has been pointed out to me that this precedent may not be applicable as the ruling was in relation to internet service being denied.

One could potentially also argue that such actions are in violation of the Computer Fraud and Abuse Act (CFAA) under the same provisions which make denial-of-service (DoS) attacks illegal. UK law also has provisions under the Communications Act 2003 and the Computer Misuse Act 1990 (CMA), with similar advice given by OFCOM (1, 2, 3) as the FCC gives.

Drone Intrusion Prevention Systems are a similar concept, designed as security devices which identify drones in the vicinity and inject commands into the control channel in order to disable them. The advertised use-case is to prevent an attacker from using a drone to spy on people's screens, or gain entry to a secured facility. The apparent functionality is that the system identifies a drone in the area, and an operator can choose to have the system disable or otherwise inhibit that drone's functionality.

One could argue that injecting commands into the control stream would constitute a violation of both the CFAA and CMA since it causes a computerised system (the drone) to stop functioning or be taken over without the consent of the drone operator.

A key thing to note in both cases is that the denial of service is not indiscriminate in terms of jamming the radio spectrum: devices operating on that band will continue to work unless specifically targeted.

47 U.S.C. § 333 states:

No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government.

It is clear to me that indiscriminately jamming a radio band is illegal under both the US and UK Communications Acts. What is not clear to me is whether interjecting additional commands is illegal, nor whether a drone user operating within the vicinity of such a device counts as "authorized" under this particular facet of law. From what I have read, the term appears to refer to communications which are not themselves in violation of the Communications Act, but I'm not certain whether this matters.

Are these devices illegal under US/UK law? Is there any precedent in this matter?

4

For the USA, the FCC has a few words to say on the subject:

“Generally, “jammers” — which are also commonly called signal blockers, GPS jammers, cell phone jammers, text blockers, etc. — are illegal radio frequency transmitters that are designed to block, jam, or otherwise interfere with authorized radio communications.” (https://transition.fcc.gov/eb/jammerenforcement/jamfaq.pdf)

In addition, the FCC specifically calls out WiFi blocking devices using deauth attacks as you described, calling them “Willful or malicious interference” in a warning they issued in 2015

This is the closest thing to precedent I could find, related specifically to WiFi . That pretty much sums it up. If the device’s primary purpose involves disabling radio communication, it is illegal. It does not matter to the FCC how targeted or filtered the attack may be, it is still unauthorized. At the core of the issue, you (a private citizen) are not allowed to interfere with someone operating their radio according to the FCC rules, no ifs, ands, or buts. Drone IPS system using such an attack would most likely be illegal. The FCC may change this interpretation in the future, but for now it is illegal.

2

UK-based answer:

With regards to rights above land, we know from Bernstein v Skyviews and General Ltd [1978] QB 479 that a person owns: "the airspace above his land to such height as was necessary for the ordinary use and enjoyment of his land and the structures upon it"

Though this wouldn't allow you to sue someone for flying a helicopter or airplane above your land, I would believe that drones would count as flying low enough as to be potentially infringing on your right.

That said, this only really means that if someone flies their drown over your land, low enough to annoy you, you could ask them to cease and desist. I don't think you would be justified in installing a "drone-jammer" or any system which injects commands to a drone to render it inoperable or to gain control over it.

In the same way that if there is an intruder to your property, you can't without warning just physically shove them off of your property.

  • 2
    While this is interesting, it only really shows that a person has the right to sue a drone operator for trespass. It doesn't cover the RF jamming aspects, which is the primary concern. – Polynomial Feb 28 '17 at 22:56
2

In the United States -

  • Flying within Class G airspace (max 400 ft.) over private property without permission is trespassing (min 500 ft.)

  • A 107 certified pilot is not restricted to 400 ft., and may have a BVLOS waiver. (It can be difficult to assess whether a drone is above 500 feet.)

  • In the US, it is a violation of federal criminal law to instigate any attack intended to interfere with the flightworthiness of a craft currently in flight. The penalties for doing so or attempting to do so are severe (especially if the attack involved ballistics, such as shooting at it with a firearm.) Throwing anything at all - a rock, your shoes, a spear, a towel, your shirt, etc. intended to deliberately cause a flying craft to free-fall.

  • FAA regulations explicitly disallow any attempt at "towing" by a craft in flight of another craft in flight.

  • CFAA absolutely applies to a drone's companion computer, which means that targeting Wi-Fi, Bluetooth or network services (including spoofing, etc.) are all illegal. Because CFAA is part of the Patriot Act, attempting to disable a drone in this fashion could lead to a terrorism charge.

  • The only generalized exemptions to this are reserved for the military and only for military purposes; shooting down a civilian's Phantom 4 with a Stinger missile is no more permissible than blowing up their car with a bazooka.

  • This includes the overwhelming majority of law enforcement including state, local, and federal, who will seek to identify the pilot with the assistance of the FAA. Once they locate the pilot, they will take control of the craft or order the pilot to land.

The only generally "legal" way to interfere with a UAV in flight is to crash into it with your own drone. This qualifies as an in-air collision, and is considered an accident.

My startup builds aerial security drones, one of which performs autonomous nuisance drone control. We do this without using any form of ballistics, RF interference (illegal without a waiver from the FCC which are almost impossible to obtain and do not scale), EM discharge, etc. We have developed a way of disabling nuisance drones (it is not considered towing if the craft is not in flight), at which point we force the nuisance drone to ground in a controlled manner (not a freefall.) At this time, we do not provide these drones to private sector pilots, including private sector commercial pilots; they are only available to law enforcement and public safety officials whose agencies / departments who are willing to obtain the waiver granting permission to use them (we will help them with this process, if needed.)

  • 1
    "The only generally "legal" way to interfere with a UAV in flight is to crash into it with your own drone. This qualifies as an in-air collision, and is considered an accident." I suspect drone-on-drone collisions will grow very common in the future, then. – JAB Mar 13 '18 at 16:21
  • There are cases where a home owner has legally shot down a drone. So you may want to revise your answer with that caveat. – Digital fire Mar 13 '18 at 18:09
  • @DigitalFire You are conflating the government's failure to prosecute with legality. You may want to revise or remove your comment. – OpenSorceress Mar 14 '18 at 6:11
  • @JAB Not likely - it is extremely difficult to manually pilot one's unmodified / hobbyist UAV into someone else's UAV, and it will only become more difficult as autonomous collision avoidance and adaptive autopilot technology continues to evolve. Also, drone insurance is quickly approaching a mandate for hobbyist pilots as well as commercial. – OpenSorceress Mar 14 '18 at 6:18
  • How does the law determine what constitutes a "craft"? Surely it's not a federal crime to throw a towel at some kid's paper airplane. Does it need to be powered? Does it need to be of a certain size or capable of rising to a certain altitude? There has to be something that distinguishes knocking down a paper airplane with a balloon attached to it for use as "fuel" and shooting down a drone. – forest Nov 11 '18 at 8:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.