Looking Up: The Security Implications of UAV Proliferation

Introduction

In the ebb and flow of the Afghanistan war, international coalition forces have historically had sole access to unmanned aerial vehicles (UAVs). The U.S. Air Force (USAF) has regularly used UAVs to monitor and neutralize Taliban forces (Khaama Press, May 16, 2018). Although insufficient to turn the tide of conflict by themselves, UAVs have given coalition forces a distinct tactical advantage.

Recent indications, however, suggest that Taliban forces are making their first forays into this space. In October 2018, during a demonstration of counter-UAV (CUAV) technologies, a USAF official revealed that Taliban fighters have been using drones to conduct reconnaissance on coalition bases. [1] This fits with current assessments of Taliban UAV capability; sufficient to monitor and surveil­—as demonstrated by a 2016 propaganda video of a Taliban attack recorded by drone—but not enough, yet, to pose a kinetic threat to international or Afghan forces.

As evidenced with Islamic State (IS) actions in Iraq and Syria, this status quo could rapidly change. IS militants defending Mosul repeatedly used modified drones to drop small explosives on advancing forces (Iraqi News, February 21, 2017). It takes minimal engineering skills to augment easily accessible, commercially available drones with low-grade armaments, and militants with more sophisticated technical abilities could seek to upgrade them with more advanced weapons or even build weaponized models from scratch. Meanwhile, lone operators can also wreak havoc with off-the-shelf UAVs.

From Afghanistan to London: The ‘Lone Operator’ Threat

The acquisition of “terrorist drone fleets” by non-state armed groups is a phenomenon that has been well-documented (Terrorism Monitor, September 11, 2017). The proliferation of UAVs, however, has security implications far beyond the world’s conflict zones. In December 2018, the United Kingdom’s Gatwick Airport—the country’s second busiest air transport hub—was forced to suspend operations for an unprecedented several days after a UAV was sighted within the airport perimeter. Over 1,000 flights were delayed and around 140,000 passengers impacted, with costs running into the tens of millions of pounds (Evening Standard, January 7). The chaotic state response shows how even first-world countries with advanced, robust security apparatuses are woefully unprepared to detect and neutralize a basic UAV flown with malicious intent.

This breach should be seen as particularly serious as there is no indication that the UAV was deployed by a non-state armed group or any trained militant (Brighton and Hove Independent, December 20, 2018). The ability of lone operators to cause widespread chaos with commercially available drones will only escalate in the future, as drones become cheaper, more advanced and more operable. The role of autonomous operating modes was neglected in reporting on the recent incident. It is a simple matter to program one or more UAVs to operate remotely, making it potentially very difficult to track down a determined operator.

How a lone operator—either deliberately or by accident—has not caused a disaster with major loss of life already is purely a question of luck. Over the past twelve months, there have been repeated near miss incidents between commercial aircraft and UAVs. For example, in October 2018, a Virgin Atlantic jet on final approach to Heathrow narrowly missed a drone by a matter of meters (Sky, October 23, 2018).

This risk is also not restricted to aircraft close to the ground. In December 2018, a drone operator flying a UAV at a distance of 10,000 feet—violating UK law—almost collided with Boeing 737 approaching Stansted Airport, Essex (BBC, December 15, 2018). Amateur hobbyists have even managed to fly homemade UAVs at 33,000 feet—the same altitude as a cruising civilian airliner (Gizmodo, March 29, 2018). The ease with which operators could bring down an airliner is a serious gap in aircraft security, one that is impossible to easily or quickly rectify and could easily be exploited by both non-state groups or radicalized lone operators.

Neither is it solely airports or aircraft at risk. Any critical infrastructure—power plants, transport hubs, ports to name a few—could find themselves impacted by hostile UAVs, as could soft targets, such as shopping centers. Furthermore, militants could utilize a small handful of UAVs to completely overwhelm host-nation security forces by simply flying them within the restricted areas of airports. This would divert law enforcement and military resources away from normal duties, potentially leaving other, more vulnerable targets open for attack. Similar tactics have been employed by IS in Iraq. IS operated drones distracted Iraqi soldiers from an inbound suicide vehicle-borne explosive device (The New Arab, February 23, 2018). While this is an extreme case, it is likely only a matter of time before tactics used in the battlefield make their way to civilian spaces, and a distraction of half the magnitude of the Gatwick incident could still prevent security forces from quickly responding to a less sophisticated attack on a soft target.

Mitigation

Governments have a role to play in protecting their countries from UAVs. Law enforcement and military forces must be prepared and equipped with the necessary training and technology to bring down UAVs quickly and safely. On a political level, nations must take steps to regulate the use of drones—in many countries a legal grey area—and ensure that their own security forces are sufficiently empowered to take action to protect life and property.

Site managers also have a key role to play. CUAV, whether in the Afghan mountains or suburban London, must adhere to some key principles. No single bit of equipment, no matter how cutting-edge, will be sufficient to mitigate UAV risk. Systems should be well-thought out and multi-layered, with radar systems supported by active tracking technology where feasible, passive tracking where not, and a variety of neutralization responses. These systems must also be supported by appropriately trained personnel; the most advanced CUAV kit is next-to-useless without the human infrastructure to maintain, monitor and operate it. Furthermore, given the limited time-frames inherent in a UAV attack, operators must be pre-authorized by the competent decision maker to escalate and deploy active countermeasures as soon as the threat necessitates action.

Moreover, stakeholders in the civilian and military communities are behind the curve with respect to developing a sense of urgency about this problem. The threat posed by UAVs to all facilities, regardless of the local security environment, is here now. Practitioners must respond immediately by factoring the aerial dimension into their security plans and investing in the technologies and personnel needed to mitigate this risk. As drones proliferate, local security managers in the UK will be united with base commanders of Iraq and Afghanistan in one key aspect—they will be failing to manage one of the key security risks of the 21st century.

Written with input from ISS Aerospace.

Notes

[1] USAF video of experiments with directed energy to take down UAVs. https://youtu.be/6y5Kh47nq2Q