Drones: Cyber Exposures

Posted October 26, 2016

Unmanned aerial drones, also called unmanned aircraft systems (UAS), are a new type of aircraft that has broad commercial and personal uses. UAS can be used to inspect buildings, deliver materials or fly around as simple, recreational products. However, as UAS become more advanced and widespread, they can represent a significant new threat to your business.

The exposures caused by UAS have been widely covered by the media. Drones have crashed at the U.S. Open, the White House and other prominent locations, and they have led to instances of property damage, severe injuries and death. Additionally, as UAS technology advances, new risks such as cyber security and privacy need to be considered.

These threats, along with the lack of comprehensive UAS regulations, make drones a new and substantial risk exposure. You need to be aware of how UAS can impact your business, and what you can do to protect it.

Consider the Technological Risks

Drone Privacy

Since most drones are small and widely viewed as advanced hobbyist aircraft or toys, you may not consider them substantial threats. However, many small UAS are already equipped with advanced cameras and listening devices, and they also present other risks to your business’s privacy.

Researchers have demonstrated that drones equipped with smartphones can access data from a business’s insecure networks and devices. Additionally, these drones can access areas that a normal person could not, such as the top floor of a building or outside the window of a secured room.

Any of your business’s Wi-Fi networks, computers or wireless printers could also be targeted by a properly equipped drone. Employees’ personal devices could be vulnerable to this same type of attack, and any business information on these devices could be compromised.

The cyber security risks of drones will only be compounded by additional features that make UAS easier to use and even autonomous. As GPS and sensor technology improves, the owner of a UAS could instruct a drone to automatically monitor your business, disrupt its operations or steal its data. Even if a drone isn’t used for nefarious activities, if one is unmonitored or forgotten, it could still crash and cause significant damage.

Be Aware of Federal and Local Regulations

UAS are still considered aircraft, and must be registered with the FAA. Here are the basic guidelines for registering UAS:

  • UAS that weigh between 0.55 pounds and 55 pounds must be registered online. If a UAS weighs more than 55 pounds, it must be registered by paper.
  • Once registered, the UAS operator will receive a registration number that must be placed on all applicable drones.
  • Registration is valid for three years. Failing to register may result in regulatory and criminal sanctions.

The FAA also has regulations that apply to both commercial and recreational UAS:

  • Drones must fly below a height of 400 feet above ground level and weigh 55 pounds or less.
  • An operator must maintain a visual line of sight with his or her drone.
  • Drones cannot fly within 5 miles of an airport, and must remain clear of all manned aircraft and obstacles.
  • Drones cannot be flown near people or open-air stadiums.
  • The FAA currently considers UAS to be in the same category as manned aircraft. As a result, any attempt to damage or destroy a drone can result in federal penalties—up to 20 years in prison and $25,000 in fines.
  • Operators should look up state and local laws concerning the use of UAS before operation.

Additionally, the FAA has released more specific rules on the commercial use of drones that weigh less than 55 pounds:

  • An operator may use a camera system to control a drone, but must also be close enough to see it if something unexpected occurs. Additionally, the operator must have a visual observer who remains in constant line of sight with the drone.
  • Operators cannot fly the drone over anyone who is not directly participating in the drone’s operation.
  • Drones may carry an external load if it’s securely attached and doesn’t adversely affect the controllability of the aircraft.
  • Operators may transport property for compensation within state boundaries.
  • Commercial drone operators need a remote pilot airman certificate with a small UAS rating, or be under the direct supervision of a person who holds such a certificate.
  • Drones used for commercial purposes must be registered with the FAA.

For more details on the FAA rules regarding the commercial use of drones, visit the FAA’s website.

Reduce Your Risks

The risks of UAS technology may seem difficult to protect against, but there are steps you can take to keep your business safe.

Ensure that your business’s networks and devices are safe from intrusion, even if they seem to be in an inaccessible location. Also, since many wireless networks operate on the same frequency as UAS, ensure that your network will not interfere with their operation and cause a crash that your business could be held liable for.

Instruct your employees about the use of UAS, and that they should never take action to damage or disable a drone. Instead, tell employees to call your local police department if they are concerned about any UAS activity. Even incidental damage could expose your employees and business to federal penalties as well as expenses for any resulting damage.

UAS Coverage and Additional Resources

Any damage that a drone causes to your property, equipment or employees will likely be covered under existing policies. However, you should speak with Horst Insurance to ensure that your policies include coverage for aircraft-related damage.

UAS have a number of associated risks, but their broad uses also have the potential to help your business. Contact us at 800-533-2011 today; we have additional resources that can help your business safely incorporate drones into its operations. These include an additional Risk Insights article, “Drones: The New Risk Exposures to Your Business,” that serves as a guide to UAS liability coverage and the risks of commercial UAS use.