The Anti-Drone Arms Race Is Taking Off

Last week, the director of the Federal Aviation Administration reported that his department is receiving an average of 2,000 new registration requests for drones every day, and that it has registered up to some half a million drones since new rules went into effect in January. But as sales of drones have increased, so too have other more worrying numbers. The FAA also says it receives more than 100 reports per month of drones flying around airports and other forbidden places, where they could damage infrastructure or accidentally collide with the engine of a landing airplane.

Then there are the more deliberate misuses: It’s thought that terrorists will inevitably use unmanned aircraft to deliver explosives, just as they’ve already been used to smuggle drugs across prison walls. Last year, the Secret Service reported at least two incidents where unmanned aircraft flew in restricted airspace around the White House, while in Japan, an antinuclear activist was charged with using a drone to deliver a tiny amount of radioactive sand to Prime Minister Shinzo Abe’s office.

Meanwhile, camera-equipped drones are already being used to surreptitiously invade people’s privacy, and they can intercept data, too, says Gilad Beeri, a software engineer with experience in cybersecurity and radio communication.

“I can buy a $300 or $500 drone and just send a device that is a computer, cloud-connected, with HD camera,” onto private property. “I can use it to hop your network, because it can come with all of those kinds of radio sensors close to your computer.”

Beeri is cofounder and chief technology officer of Palo Alto-based ApolloShield, one of a number of startups and defense companies selling ways to take down drones behaving badly.

Unlike physical options for taking down a drone—which have included nets, guns, and birds of prey—ApolloShield’s handheld device leaves drones intact and functional, sending them back to their pilots nearby, Beeri says.

“The drone never crashes, just goes back to the operator and lands safely near the original operator,” he says.

Beeri, 30, and his friend and cofounder Nimo Shkedy, 33, who honed their cyber skills in Israel’s elite cyber agency Unit 8200, first focused on the drone problem in 2014, according to a report on the blog of the incubator Y Combinator. While the pair were watching a soccer game between Albania and Serbia, a drone carrying an Albanian flag zipped into the stadium, causing havoc. A few weeks later, they were playing volleyball at the beach when a quadcopter with a professional camera began hovering ominously overhead. Beeri and Shkedy resolved to develop a solution.

ApolloShield, which resembles a wireless router and costs about $30,000 a year, is designed to detect nearby drones up to two miles high—well above the FAA-established ceiling for drones of 400 feet—and record their unique identifying numbers. It also gives its users the option of spoofing the drone’s “go home” signal, ordering them to return to their operators and land.

The process involves buying commercially available drones and reverse engineering the ways they communicate, something that generally takes about two weeks per model, Beeri says. “We actually learn the language of the drone and the remote control, and we teach our system how to speak that language,” he says.

As new drones come on the market, the company can push updates to its customers, who, he says, only include those in charge of protecting airports, stadiums, prisons, power plants, and other critical infrastructure.

So far, Beeri and Shkedy have raised $500,000 from Y Combinator and other angel investors. They declined to name any of the company’s existing customers, but in an email Beeri wrote that “each customer is screened and vetted on a case-by-case basis, depending on vertical and geography. The purpose is to make sure only customers who should be able to have such a system get it. The process is still being formalized with time so I can’t share any more details right now.”

Unmanned But Not Unlawyered

There are no specific rules about who should use an anti-drone system or under what conditions, as there are about drones themselves. Under FAA rules that went into effect this summer, drone pilots are required to register aircraft weighing more than roughly half a pound with the agency, and commercial pilots are required to obtain a special certificate from the FAA. Anyone flying a drone within five miles of an airport is required to coordinate with air traffic controllers, and commercial pilots aren’t allowed to fly over people or launch from a moving vehicle.

Additional restrictions apply to secured airspace around Washington, D.C., and various military installations, according to the FAA. Drones also aren’t allowed near certain high-profile sporting events or firefighting operations, and some states place additional restrictions on where, when, and how drones can fly and take pictures.

Still, there aren’t yet any standardized technical measures for keeping unmanned vehicles from going where they don’t belong. Generally, federal law and FAA regulations make it illegal to damage or tamper with any aircraft, including drones, and Federal Communications Commission rules make it illegal to jam any kind of radio transmissions, according to Dallas attorney Jason Melvin, who’s been called the “Texas Drone Lawyer.” But, he says, courts have yet to specifically deal with the question of the legality of anti-drone systems.

“None of these issues have been litigated, and there aren’t a lot of laws and regulations that address the situation yet,” says Melvin. Even in cases where, say, federal law enforcement agencies are granted permission to take down drones, there are still likely to be questions of liability if a drone is unintentionally damaged, or even crashes into someone, when it’s sent an overriding signal, he says. Moreover, a powerful signal from an anti-drone jammer could also disable other nearby communications technology, like cell phones and navigation systems.

ApolloShield says its customers are required to comply with local laws, wherever in the world they’re based, and some customers have asked for restrictions to be applied to their devices to ensure compliance.

Research and development firm Battelle also offers an anti-drone device, a rifle-shaped anti-drone radio transmitter called the DroneDefender, but Federal Communications Commission regulations on radio transmissions mean the company can only test it under restricted circumstances and can’t sell it to civilians. While Battelle is reluctant to disclose too much about which federally authorized customers are using the DroneDefender, Battelle researcher Dan Stamm says it’s sold about 100 of the devices to the Department of Defense and Department of Homeland Security. In July, one was spotted on a military base in Iraq. The devices run in the five-figure range, he says, and well less than $100,000.

The rifle-shaped radio transmitter and external 10-pound battery pack wouldn’t look out of place in the Ghostbusters arsenal. Because the DroneDefender is directional, it shouldn’t interfere with drones—or perhaps other electronics—that aren’t in its line of fire, according to Battelle researcher Alex Morrow.

While ApolloShield’s device sends a drone back to its operator by impersonating a drone’s operator and sending its own commands, the Battelle device effectively blocks the radio signals the operator is sending. It transmits a “proprietary waveform” that’s designed to interfere with any commercial drone it’s aimed at, without needing to understand the specifics of how the device communicates. (Most commercial drones are programmed to safely return to their pilots when they lose signal.)

“We really wanted to focus on not destroying the aircraft in the air,” says Morrow. “Many of the incidents are just wrong place, wrong time—maybe a 14-year-old kid flying their aircraft too close to the airport and not knowing the rules involved.”

Some drones can be self-programmed to avoid sensitive areas, like airports or private property, a feature that popular Hong Kong-based drone manufacturer DJI began to include on its newer drones, with a restriction on flights around Washington, D.C.

But government and military agencies aren’t taking any risks. Last year, it was revealed the Secret Service was testing a drone shield around the White House, and the FAA and Department of Homeland Security began testing a drone detection system earlier this year intended to locate errant drones around airports and other secure locations and one that can both detect and block radio communications with misbehaving drones. To stop drones from interfering with firefighting aircraft during wildfires, the Interior Department announced in July that it was testing a “geofencing” system to send software warnings to nearby drone pilots, as part of a collaboration with the drone industry.

Meanwhile, NASA and the Defense Advanced Research Projects Agency, the Pentagon’s R&D arm, are developing and seeking proposals for building a system that could track all drones flying below a certain altitude across a city, perhaps using tracking systems mounted on additional drones.

Stamm, who developed the DroneDefender with Morrow, says that no anti-drone system will work every time. “There are certainly drones that are out there, that will be resistant to our effects, for sure, but we like to say that we’re effective against the vast majority of commercial [unmanned aircraft] that are out there.”

Anti-drone vendors will struggle to stay one step ahead of drone makers in the quest for vulnerabilities. “Like any kind of security company, it’s always a bit of an arms race,” says Grant Jordan, CEO at anti-drone tech startup SkySafe. SkySafe provides a subscription service including hardware and software to identify, land, and potentially even take control of unauthorized drones. The company’s currently focused on the public safety market as it builds out new capabilities, and is not currently selling to individual end users, says Jordan.

The security flaws used by anti-drone devices could also be used by people with less beneficent intentions to hijack legitimate drones. In March, an American researcher demonstrated he could hijack a heavy-duty quadcopter used by police and fire departments and in industrial uses from a mile way, with only a laptop and a cheap digital radio. Not only was the drone’s Wi-Fi connection dependent upon “WEP” encryption, which is known to be weak, but the connection between the operator and the drone used an even less-secured radio protocol, leaving the drone open to a man-in-the-middle attack. Such vulnerabilities, he told the RSA security conference, may apply to a broad swathe of high-end drones.

Meanwhile, with rules around anti-drone equipment still unclear, it’s not certain when consumers will be able to legally buy, build, or use tools to keep unwanted drone flights away their property, says Jordan. “For some of these things, we’re just going to have to wait and see.”