‘Privacy zealots,’ hijackers among municipal drone threats, report warns

Unsecure software, shared airspace, a lack of standardization and disgruntled citizens — cities have a host of challenges to consider as municipal drone programs grow near, according to a security report released Thursday.

The report — called Establishing a Safe and Secure Municipal Drone Program — was published by the Cloud Security Alliance (CSA) and Securing Smart Cities nonprofit as a resource for urban leaders evaluating the challenges, threats and privacy considerations of municipal drone programs.

The CSA report concludes that drones will play a key role in the future of smart cities — from medicine and transport to agriculture and law enforcement — and so cities and vendors need to develop drone platforms that are both reliable and secure if the technology is to meet its potential. Security threats abound.

Drone adoption is increasing, with more than 2.6 million commercial drones projected to be shipped by 2025, according to research and consulting firm Tractica. Seattle issued an RFI including possible drone use on Monday, as the city looks for new technologies and partnerships to drive broadband availability and combat the city’s digital divide. In the private sector, delivery drone company Starship Technologies reported $17.2 million in new investor funding in January as it offers its land-based drone services in 10 American cities.

Key challenges in municipal drone adoption identified by the report include:

• A tendency by vendors to overlook comprehensive security measures
• The possibility of drones being used as an attack vector if integrated into a citywide Internet-of-Things system
• Lack of standardized regulations
• Unproven algorithms supporting operations and inter-drone communication
• Consumer drone development will continue to accelerate, therefore making it challenging for governments to keep pace with their own technology.
• The physical separation of a drone and its operator inherent in drone use gives the activity an anonymous characteristic that is potentially fraught with law enforcement and regulatory challenges.

Privacy considerations highlighted by the report include that drones can include facial recognition capabilities that track members of the public, audio and video monitoring that could eavesdrop on people, and sensors that could identify people and objects even behind walls. All of these technologies, the report notes, could be abused or hijacked.

A table of possible threats to drone systems included in the report illustrates that variety of challenges technology leaders will face in adoption, including “privacy zealots,” weak encryption, and spoofed GPS signals. Outcomes from these threats range from temporary service disruption to the drone turning against cities and their inhabitants to serve its hijackers.

The report recommends leaders build strong governance and policy frameworks to help contend with these many challenges. A configuration control board (CCB) is noted as one of “the best” ways to ensure high level policy frameworks are followed.

The full 29-page report — Establishing a Safe and Secure Municipal Drone Program — can be downloaded from CSA, here.