Drone rules put critical infrastructure airspace in the policy spotlight

With roughly two weeks left for public comment on FAA Section 2209, critical infrastructure operators are running out of time to shape rules that could determine whether sensitive facilities can restrict drone flights over their sites.

The proposed rule would establish unmanned aircraft flight restrictions for qualifying fixed-site facilities. The comment period closes Aug. 5. A separate counter-drone rule under the SAFER SKIES Act remains open for comment until Sept. 4 and could shape how state, local, tribal and territorial law enforcement agencies carry out counter-UAS operations.

Together, the two rules put a long-running policy gap into sharper focus: Much of the nation’s critical infrastructure remains exposed to low-altitude drone activity, and the government is still sorting out who has the authority to act when a drone becomes a threat.

L. Scott Parker, founder of Aerisq and former chief of UAS security at the Cybersecurity and Infrastructure Security Agency (CISA), said on the Cyber Focus podcast that many infrastructure operators may assume more protection already exists than federal policy actually provides.

“A vast majority of our critical infrastructure is open airspace,” Parker said.

That includes some of the country’s most sensitive facilities. Parker said that “of the 90-something nuclear facilities, less than five have active flight restrictions over them,” calling it “a sobering thought.”

Section 2209 would not treat every restricted site the same. Parker said standard UASFRs would likely cover most qualifying critical infrastructure, while still allowing commercial operators to fly over a facility with notice. Violations would carry civil penalties.

Special UASFRs would be stricter and would apply to facilities with a stronger national security basis or more hazardous operating environment. Flights over those sites would require permission from the FAA, and violations could carry civil and criminal consequences.

But even the strictest restriction is not physical protection. Parker said Section 2209 would not prevent a drone from flying overhead.

“It is akin to a ‘no trespass’ sign,” Parker said. “It just tells someone that you should not be flying over. If you do, there’s consequence.”

The rule could give infrastructure operators a clearer path to report violations to law enforcement. But once a violation is detected, the harder question becomes: who can legally do anything about it?

That is the debate the SAFER SKIES rule begins to address. It could move more counter-UAS authority toward state and local agencies that are often closest to the scene, but it would not eliminate the need for clear guardrails around who can act, what tools they can use and when a response is justified.

Parker said that shift is necessary because drone threats are ultimately local and immediate. Federal agencies may set the rules, but usually won’t be the ones standing outside a facility when a drone appears overhead.

If Section 2209 and SAFER SKIES roll out well, Parker said the next step may be giving critical infrastructure security teams more authority to protect their own sites.

“I can see in the next 5 years Congress being amenable to delegating that same authority down to the critical infrastructure security staff,” Parker said.

You can find the full conversation and other Cyber Focus episodes wherever you get podcasts or at McCraryInstitute.com