Drones: worrying about the sideshow and not the main event By Ken Dunlap

Drones: worrying about the sideshow and not the main event By Ken Dunlap

The last twelve months have been a banner year for industry experimentation in countering rogue drones. Responses to sightings at Gatwick and Heathrow resulted in flights being cancelled for 150,000 passengers and delays for thousands more. In relation to the Gatwick incident, a couple were arrested, cleared, and released. Millions of pounds were spent on technology designed to counter unmanned aircraft systems (UAS), which was rushed to the alleged scenes of the crimes and presumably victory declared – at least by the system manufacturers.

“…sightings at Gatwick and Heathrow resulted in flights being cancelled for 150,000 passengers and delays for thousands more…”

As these events unfolded, let’s explore what else happened during this same time period in global commercial aviation. If 2018 were like any other year, according to the Flight Safety Foundation in the US, 243,000 people were injured globally on ramps and US$10 billion of damage was caused. If 2018 were like 2016 then, according to the US Department of Transport, there were on average 13,408 bird strikes globally with 586 causing damage to aircraft.

Let’s put these events and statistics in perspective. In aviation, we are now more likely to suspend flight operations over an uncorroborated drone sighting report than we are to suspend airport operations to prevent ramp injuries or animal strikes. We expedite multi-million-dollar procurements and can’t even say where drones fit in the industry threat matrix. Why does this matter?

In the rush to react to drones, we are failing to place this threat within context, map the vulnerabilities of aviation-critical infrastructure in relation to it, and engage in the education necessary to understand drone technologies. All of these steps must come before we close airports, arrest individuals, and deploy countermeasures. More worryingly, by engaging in today’s ‘fire, ready, aim’ industry-protection paradigm, we are blinding ourselves from the real threat: autonomy. Simply put, what we face today is but a short sideshow of primitive technology that heralds the more daunting, long-term threat.

Make no mistake, a new generation of drones relying on autonomy is taking to the skies now. These vehicles use machine-perception systems and machine learning to sense their environment and guide themselves. They understand their environment and intelligently navigate in order to optimise mission accomplishment. This is the main event. The sideshow is the soon-to-be-obsolete systems that we see today that rely on external command guidance, whether GPS or an operator wearing goggles.

Why does autonomy really matter? In the age of vehicles that sense their world, then understand and react to what they are perceiving, autonomy allows for unprecedented precision in mission accomplishment. Autonomy allows for flight through a forest canopy to a destination that may be on the other side of an open window. Autonomy allows for millimetre precision in delivery of munitions all the while avoiding, anticipating, and reacting to dynamic changes in the vehicle’s environment. In short, it takes us as close as we can get to 100% assurance a given mission will succeed.

Before we can build countermeasures against today’s drones or the rapidly approaching autonomous ones, we need to lay the foundation. What follows are some lessons and thoughts based on our research — all of which can be executed by you and your teams today.

Educate your organisation on the basics of how drones fly

First, organisations need to commit to understanding and providing education on drone capabilities. During our 2018 drone study we were surprised by the misinformation, mythology, and lack of foundational knowledge involving these systems. In the course of the research we met with well-intentioned industry decision-makers who assigned attributes to drones that were contrary to basic principles of aerodynamics and physics. There was misunderstanding in areas such as airspeed capabilities, battery life, effect of weight on range, effective command signal range, GPS guidance, and operational procedures.

Educate your organisation on how drones attack

Second, our research also showed a lack of understanding of common methods used by drone operators to deliver ordinance and cause damage with these systems. We saw limited knowledge on how targets are tracked, weapons delivered, and battlefield effectiveness. Also missing was knowledge of the vulnerabilities present in these systems and how to exploit them.

Understand that the body of verifiable battlefield information is small

While drones have been employed in the Middle East, the reality is that verifiable information on their use and lethality is largely unavailable. Mythology and hearsay seem to fill this knowledge gap. During a year of research, we have found that many reports cannot be corroborated, others are duplicative in quantity, and some basically are disinformation by the combatants. There is very little to take to the bank based on this knowledge.

Identify precisely what you are trying to protect

Third, as a general rule, organisations concerned about drones have not performed basic due diligence by identifying the ‘crown jewel’ infrastructure that they are trying to protect. We see a “we must protect everything” mentality on the topic. While understandable, this mindset creates two problems, one immediate and the other long-term.

“…if 2018 were like 2016 then, according to the US Department of Transport, there were on average 13,408 bird strikes globally with 586 causing damage to aircraft…”

The immediate problem: infrastructure operators look for countermeasures that do not exist. There is no such thing as a wide-area denial system for drones, regardless of the picture the glossy marketing brochure paints. The more problematic and dangerous long-term issue is that it lulls the industry into believing that tomorrow’s threat looks like today’s threat. Rest assured, it will not.

In this regard, we need to understand these rapidly approaching autonomous systems are more akin to snipers than bazookas. They will be developed at a high cost measured in dollars and hours of programming (the age of throw-away autonomous drones may not arrive for a long-time). So, if an adversary takes the time and money to deploy an autonomous drone with millimetre precision in targeting, logic would say your adversary is going to use that against your most valuable target. That’s why you need to identify what you are protecting.

Up to this point in the history of drone development, security practitioners have had a pretty good understanding of some of the paths needed to build counter-UAS systems. These generally fall in five basic categories: education, basic perimeter protection/surveillance, kinetic weapons, electronic jamming focused on the command and control systems of a drone, and denial/spoofing of GPS signals.

Most of today’s countermeasures work by exploiting basic vulnerabilities in the control systems used to stabilise and navigate the drone. The truth today is that the drones you see and read about rely on external data sources for guidance, whether it is one of the global positioning systems (GPS) or operator commands through a telemetry link.

Eliminate correct GPS signals and within 30 seconds the drone loses its sense of position. Jam the command link and the operator immediately cannot steer the vehicle or drop ordinance. Tomorrow’s autonomous vehicles rely on internal sensors to sense their environment and guide themselves. GPS and command links are not required.

For these types of autonomous vehicles, security forces will need to have a different suite of countermeasures that include advanced materials, coatings, and deception. That is because autonomous vehicles rely on machine perception systems, such as light detection and ranging (LiDAR), camera arrays, or even radio detection and ranging (RADAR) to build a picture of their world and navigate through it to achieve mission success.

We need to start thinking about how we are either assisting the vehicle’s perception systems in building that picture of the world or what we can do to render these sensors blind to their world. This includes using architectural features, coatings, and light to our advantage. It includes understanding the machine-learning process that underlies how vehicles recognise and classify what they see.

Consider this scenario: an adversary has developed an autonomous system that incorporates a rule called ‘see and avoid people’ as part of developing a route and navigating to its target. Certainly, stealth is a good countermeasure for the vehicle.

In this scenario every person the vehicle sees, it will avoid. But what if we were able to project hundreds of images of humans in front of the vehicle? Maybe these ‘humans’ are just a series of random patterns that an algorithm will confuse for a human. You will get the vehicle to react to a scenario you build in front of it. Then what if this projected field of ‘humans’ cause the vehicle to veer away into a kill zone you created? You have the vehicle operating on your terms now. You’ve effectively hijacked it using the measures it was programmed to protect itself with.

That’s how we need to be thinking because these vehicles are here now. You can read more on this topic at http://www.catalyst-go.com/countering-tomorrow


Ken Dunlap is managing partner at Catalyst-Go.