shift change 2024-2

Welcome to shift change, reports from the off-going watch to the oncoming on anything interesting in privacy, security, or intelligence. 

1. With a FAA Part 107 License, you can fly a drone you can see, but what security systems need to be in place when you want to fly drones outside your line of sight?

Drones work by wireless radio signal. When they are within your line of sight (meaning you can actually see the drone) you also have radio line of sight (a clear path between the controller in your hand/phone, and the drone’s receiver), with some basic knowledge and a test you can fly. But the real benefit of requiring licensed flyers to be within line of sight of their drone is—if something happens, whether it falls out of the sky on a hapless victim’s windshield, or loses signal and fails to return to it’s base location, you are physically nearby to act. 

But what system replaces you being close enough to act, when drones are able to fly further and faster and licensing may open up to beyond your local area line of sight? Well, frankly, a whole new system of radio signals! 

From a cybersecurity perspective, a centralized management system for entire classes of drones means an entire new attack surface. The FAA has plenty of experience organizing the skies, and frequency management is also old hat for the federal government. But, even without a scientific analysis, the sheer volume of small drones that could find their way into the sky compared to the number of traditional piloted aircraft makes the scale of the problem much larger. Drone fleet security may need its whole own long form write-up.

2. TechCrunch did a write-up on big name incidents poorly handled, if you haven’t seen it it is worth a few moments read, even if you just skim for the key words like “hid” or “failed.”

3. Wired did a similar piece, but not on the poor handling of incidents, just on the impact, from teenagers taking down hotel and entertainment giants to cl0p and MOVEit.