Sales of commercial-grade drones will soar from 80,000 units in 2015 to more than 2.6 million annually by 2025, market intelligence firm Tractica predicts. Municipal uses will drive that growth as cities look to drones to help manage traffic, monitor pollution, deter crime and perform a host of other functions.
The rise of the urban drone array will bring with it a range of challenges. How to secure the fleet, access needed intelligence-processing services and protect citizen privacy? The National League of Cities has issued a warning: “Drones raise safety, privacy, nuisance and trespassing concerns, all of which are compounded by the lack of accountability associated with most drone operations today,” it noted in a recent report.
The Cloud Security Alliance begins to address these issues in a newly released guide, Establishing a Safe and Secure Municipal Drone Program.
Security needs to be a primary concern as cities face the potential for bad actors to take control of drones or tap into their intelligence.
“It’s analogous to the broader IoT market, where manufacturers are not really putting a lot of rigor into security engineering in these products," said Brian Russell, an author on the report and chair of the Cloud Security Alliance IoT working group. "They are just focused on getting new functionality into their platforms."
Without security baked in by the manufacturers, it would be possible to hijack an unmanned aircraft and steer it off course, for example by spoofing GPS. Likewise, criminals could exploit a weak security profile to tap into drone-generated data.
“Today’s drones don’t generally have access to the Internet or the cloud, but that is changing rapidly. Cloud is going to play a big role in drone management: There will be interconnectivity between the drone and the cloud, the data systems, the analytic systems, the machine learning systems,” Russell said. “All these interfaces represent potential places where someone could impact the drone’s operation.”
The report recommends cities take proactive steps during the acquisition phase to ensure as much security as possible is front-loaded onto their drone platforms. “You need to be talking to your vendors about the security capabilities. At a minimum, any command-and-control links should be encrypted and protected to ensure the data can’t be tampered with," Russell said. "That’s the first place to start — with the vendors who are building these platforms.”
Municipalities also will need to look at their own internal processes. Most cities have protocols in place to address cyberincidents. Those looking to put an unmanned intelligence fleet aloft will need to extrapolate those policies to cover new contingencies.
“What will you do if a drone goes missing? How will you know when someone tried to hack into your drone?” Russell said. “You need to follow your security lifecycle practice on the back end. Look at your cyberincident response procedures and adapt them for the drone environment.”
The new SLA
In the world of software as a service, city IT leaders have learned the value of the service level agreement, or SLA, and the document that spells out the obligations of a software provider to ensure continuous and reliable availability.One may think of a drone as flying software. The physical aircraft is just the delivery mechanism: The true IT muscle here is in the processing, and tech executives will need to ensure they manage that processing potential just as they do their other software investments.
“We don’t want to see municipalities go out and purchase a set of drones and then find those tools aren’t available when they need them because someone has messed with the configuration or for some other reason," Russell said. "There has to be a way to build resilience into this."
Just as the IT shop insists on solid SLAs for its software and services, “you want to make sure that drone services are supported in the same manner,” he said.
Those relationships will likely span a broad swath of new providers. “There are aerospace intelligence centers coming up that deliver data to ground operators and to the drone itself. There are unmanned system traffic management services. There are weather data feeds," he said. "You need reliable real-time access to these services or else you run the risk of flying into an area that you shouldn’t be flying into."
Privacy plans
A drone is a flying sensor; it’s a spy designed to take pictures and shoot video, among other tasks. There is, naturally, some social discomfort around this at the present. In the eyes of the general public, the privacy rules around this new capability are vague at best. Cities must tread lightly.“Communicating with your stakeholders is critical, making sure they understand that you are going to be flying these drones, that this is what you will be doing with that data and that imagery,” Russell said. “Then you have to follow through and do what you say you are going to.”
In order to have that candid conversation, civic IT leaders will need to convene with all end users of the data to work out a clear understanding among themselves as to the scope and intent of the drone deployment. “You need to sit down and think about the governance over what you should be doing with that data,” Russell said. “How will you protect it? What will you do when law enforcement needs access to that data? What are the ground rules around sharing it?”
At a minimum, the data must be kept secure. “You need to apply encryption to the sensor channels, if you are offloading information," he noted. "You apply encryption in transit, encryption to data at rest. That’s the bare minimum.”
By way of caution, Russell notes that the UAV technology landscape is evolving at a brisk clip. A lot of what’s needed today is already familiar. SLAs, encryption: It’s largely a matter of taking what we know from conventional networks and applying it to a new platform.
But all that is about to change, he suggested. In the near future UAVs will follow the cues from Detroit, which is pushing hard in the direction of autonomous automobiles. The arrival of the driverless car will likely spark the launch of autonomous drones, whole fleets of self-directed spy-fliers zipping through the urban airspace.
That’s going to change the security conversation considerably, Russell said, and the best way to prepare for it is by getting on top of drone security now, why we are still in the realm of the (relatively) familiar.
