Citing “concerning [unmanned aircraft system] activity over sensitive critical infrastructure sites,” the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency has published multiple guides to help critical infrastructure operators address the security risks posed to their systems by drones.
CISA released the guidance as part of its Be Air Aware initiative, aimed at promoting awareness of drone risks. The agency wrote in a blog post that drones “are affordable, easy to modify and have advanced capabilities, making them a unique and multifaceted threat to critical infrastructure.”
“The new risks and challenges from UAS activity demonstrate that the threat environment is always changing, which means our defenses must improve as well,” CISA Acting Director Madhu Gottumukkala wrote in a separate press release. “CISA’s Be Air Aware resources are designed to empower critical infrastructure owners and operators with the information they need to better safeguard their systems and assets.”
To illustrate the risk, CISA pointed to the case of Skyler Philippi, arrested by the FBI in November 2024 for plotting to rig a drone with explosives and fly it into an electric substation near Nashville in furtherance of a “violent white supremacist ideology,” according to then-Attorney General Merrick Garland. (See Feds Accuse Tenn. Man of Substation Attack Plot.) Philippi pleaded guilty to the charges in September.
Each of CISA’s three guides, released Nov. 19, covered a specific aspect of drone risks. In the Unmanned Aircraft System Detection Technology Guidance, the agency reviewed systems for identifying and tracking nearby drone activity, grouped into three key steps: establishing capability requirements for UAS detection systems, determining the most appropriate technology for the site and integrating drone detection technology into existing security plans.
The Suspicious Unmanned Aircraft System Activity Guidance was created for critical infrastructure operators who have detected drone activity near their facilities and need to determine their risk level. CISA emphasized in the guidance that “most UAS activity is likely non-threatening to critical infrastructure operations and compliant with Federal Aviation Administration … regulations,” but encouraged organizations to develop procedures for distinguishing between safe and suspicious activity.
Operators should determine the normal level of drone activity in the area and communicate that information to security staff, CISA wrote. This can be done by contacting the FAA, government and community stakeholders and local hobbyist groups and asking where drone activity is permitted and when special events may include drones. Operators may survey the surrounding areas to identify locations that might attract drone users.
They should monitor for indications of suspicious drone activity, such as hovering near sensitive locations, flying in patterns and carrying observable payloads such as sprayers or dangling wires. If these are detected, organizations should engage with the operator if possible to learn the purpose of the flight and negotiate adjustments to avoid the facility. If this effort is unsuccessful and the activity poses a security or safety risk, law enforcement may need to be contacted along with the FAA.
Finally, in the Safe Handling Considerations for Downed Unmanned Aircraft Systems document, CISA advised critical infrastructure operators on preparing for and responding to grounded drones from unknown sources on their property. The agency said that while crashed drones often result from nothing more than “a reckless or inexperienced operator,” organizations must consider the possibility of “something more nefarious, including criminals conducting surveillance or weaponizing the UAS with explosives or cyberattack capabilities.”
Steps to respond to downed drones include securing the area by restricting access to authorized personnel and recording incident details for first responders and investigators. Organizations should consult with law enforcement on issues such as determining the owner of the drone and whether to return it if the drone was crashed accidentally.
