WHITE PAPERThe Utilities Airspace Defense Playbook: From Detection to Intelligence Driven Security

A strategic guide for utility security teams to transition from passive drone detection to proactive, law-based enforcement and intelligence-driven defense.

Executive Summary

For utility providers—spanning expansive substations and power generation plants—the threat of Unmanned Aircraft Systems (UAS), more commonly known as drones, is no longer a theoretical concern; it is an operational reality. Drones have fundamentally shifted the threat landscape, providing an accessible platform for high-definition aerial reconnaissance that easily bypasses traditional perimeter fencing.

For utility operators, the primary threat is an intentional act of sabotage designed to trigger a massive, cascading outage. However, a more frequent challenge to grid reliability has emerged: the 'Clueless and Careless' Hobbyist. As recreational drone use continues to surge, utility sites are seeing a rise in unauthorized flights from hobbyists who are simply unaware of the rules or the risks involved. Whether it is a malicious actor scouting a transformer bank or a hobbyist flying "too close" for a photo, the result is the same: an unacceptable risk to critical infrastructure.

Utilities Airspace Defense Challenge
The essential paradigm shift is moving your focus from the Aircraft to the Operator.

While the Federal Aviation Administration (FAA) owns the air, state and local authorities own the ground. By shifting your strategy to identifying and locating the pilot, you move the incident into a jurisdiction where local law enforcement can act. You aren't "attacking a drone"; you are "interdicting a person" who is violating state trespassing or critical infrastructure laws.

This guide provides the operational roadmap to leverage drone detection systems to identify, document, and build 'prosecution-ready' reports.

Beyond the technology, we provide a strategic framework for enforcement, including specific examples of state and local laws—from Critical Infrastructure Protection (CIP) statutes to modernized 'Peeping Tom' and Trespass laws—that your team can leverage today.

By turning digital data into actionable evidence, you move from passive observation to active enforcement and prevention, ensuring that both malicious actors and reckless hobbyists are held accountable under the full extent of the law.
Utilities Airspace Defense Solution

Section 1: The Ground Game: Leveraging State and Local Laws for Drone Incursions

The FAA governs the flight. However, state and local authorities govern the criminality of the operator's actions. As a utility, you have six primary legal levers to pull.

Before we jump in, it is important to note that these laws are not self-enforcing. To a District Attorney or a responding officer, a visual sighting of a drone is merely "anecdotal." To secure a citation or conviction, the legal system requires objective, digital certainty.

Throughout this section, we will highlight how drone detection technology serves as the bridge between a violation and an arrest by providing the "Forensic Data Package" (GPS logs, serial numbers, and 3D flight paths) required for prosecution.

We will dive into the specific technical requirements for these systems in Section 3 , but first, you must understand the legal levers they are designed to activate.

1. Critical Infrastructure Protection (CIP) Statutes

Over 30 states now have specific laws prohibiting drones from flying within a set distance (usually 400ft) of "target facilities."

The Law: It is a criminal offense to fly over or near power plants, substations, or water facilities.
How to use it: Your detection system provides the telemetry log that proves the drone crossed that legal boundary. Without this data, an officer cannot verify the distance breach required for a citation.

2. Potential Criminal Trespass & Privacy Violations

While the FAA regulates U.S. airspace, utilities and other critical infrastructure operators may have legal protections against certain low-altitude drone operations, surveillance, or interference depending on state and local laws.

The Law: Many states have enacted statutes restricting drone-based surveillance, critical infrastructure overflight or other unauthorized aerial activity under specific circumstances. Violations often depend on operator intent, proximity to protected assets, and whether the activity involves surveillance or operational interference.
How to use it: Documented drone activity can provide important evidence for security investigations and support coordination with law enforcement when flight behavior suggests unauthorized reconnaissance, surveillance, or other potentially prohibited activity near utility infrastructure.

3. Harassment & Stalking

If a specific operator repeatedly targets your facility or employees, it crosses from "nuisance" to "criminal harassment."

The Law: Repeatedly flying a drone near a specific person or facility after being warned to stop may trigger harassment, stalking, or related criminal scrutiny depending on jurisdiction and conduct.
How to use it: Your system’s historical data allows you to show a "pattern of behavior." Proving that "Drone Serial #XYZ" has been at this substation three times this week is the key to a harassment charge.

4. Launch and Recovery (The Ground-Control Lever)

While the FAA controls the flight, they do not control the ground.

The Law (On-Property): A utility facility is restricted, private, or secure property. If a pilot enters your easement, right-of-way, or facility perimeter to launch, recover, or operate a drone, they are committing Criminal Trespass—and in many states, a felony-level violation of Critical Infrastructure Protection (CIP) laws.
The Law (Off-Property): If the pilot stays off your land but stands on nearby public property (like a municipal park or sidewalk), local governments cannot regulate their flight, but they can restrict their ground operations. Many municipalities explicitly ban the physical launch, landing, or operation of drones from public parks or specific rights-of-way.
How to use it: If the detection system alerts you that the pilot’s GPS coordinates are inside your facility’s property lines or easements, dispatch internal security or local law enforcement immediately. Instruct responding officers to arrest or cite the operator for Criminal Trespass or Critical Infrastructure violations based on their physical presence on your secure land. If your system identifies the Pilot GPS on nearby public property (like a city park or sidewalk), check for local drone-launch bans. You can have law enforcement cite the operator for an unauthorized ground launch/operation under local municipal code, completely independent of their flight path.

5. Reckless Endangerment (The "Public Safety" Lever)

This is a standard criminal charge that local police already understand. You don't need a drone-specific statute to utilize this in any of the 50 states.

The Law: It is illegal to create a "substantial risk of serious physical injury" or significant property damage through reckless behavior—such as flying within the "flash zone" or arcing distance of high-voltage equipment.
How to use it: By utilizing 3D flight path data, you can prove the drone was flying within feet of energized assets (e.g., busbars or transformers). Documenting this proximity allows police to charge the pilot with Reckless Endangerment because a crash could trigger an explosion or fire, endangering both site personnel and the public.

6. National Security "Covered List" Violations (2026 Update)

This is a strategic lever following the 2026 FCC and DHS "Covered List" updates regarding foreign-manufactured drone technology.

The Law: As of early 2026, specific foreign-made drone systems and their communication components are classified as national security risks under the FCC "Covered List," restricting their use near sensitive U.S. critical infrastructure.
How to use it: Detection systems can identify the Manufacturer and serial number of the drone. If a device from a "Covered List" manufacturer is flagged loitering over your substation, the incident can be escalated to the FBI or DHS as a potential national security threat. This often triggers a much higher priority response than a standard local nuisance call.

State Enforcement Examples

State Primary Statute Utility Application
Texas Gov. Code § 423.0045 Felony to fly over "Critical Infrastructure" facilities.
Florida FS § 934.50 Prohibits unauthorized surveillance; allows for civil lawsuits.
Arizona Rev. Stat. § 13-3729 Specifically prohibits loitering or photographing near critical facilities.
Tennessee TN Code § 39-13-903 Class E Felony to fly within 250ft to conduct surveillance.
Louisiana R.S. 14 §337 Prohibits unauthorized surveillance, data gathering, or recording of critical infrastructure.
Arkansas AR Code § 5-60-103 Prohibits gathering evidence or recording critical infrastructure.
Michigan HB 5319 Criminalizes hovering over or trespassing on critical infrastructure.
Oklahoma HB 2599 Civil liability for damages; prohibits flights below 400ft.

Important Note for Security Directors

The information provided in this playbook is for educational and informational purposes only and does not constitute formal legal advice. These state enforcement examples are not exhaustive and are intended for informational purposes only. In 2026, state and local drone statutes are evolving rapidly, with many jurisdictions introducing "emergency" amendments to protect critical infrastructure. We strongly recommend consulting with your corporate legal counsel and local Law Enforcement Liaison to identify the specific ordinances applicable to your facility's zip code. AeroDefense is a technology provider, not a law firm, and reliance on any legal frameworks presented herein is at the user’s own risk.

Section 2: The Anatomy of an Actionable Incident Report for Utilities Airspace Defense

Law enforcement and the FAA increasingly rely on Radio Frequency (RF) telemetry because it is objective, timestamped, and difficult for a pilot to refute. Data is more durable than video.

When the "detect" alarm sounds at a substation, the goal is to generate a report that an officer can act upon immediately. Drone detection systems automate this by compiling a Digital Evidence Package containing:

The "Who" (Pilot & Aircraft ID)

Remote ID & Serial Numbers: Unique identifiers that link the drone to its registered owner.
Pilot GPS Coordinates: The exact location of the operator. This is the most critical data point for a patrol officer.

The "Where" (Geofence Breach Documentation)

Altitude & 3D Flight Path: Proves the drone was low enough to be considered a nuisance or a threat to equipment.
Dwell Time: Documentation of how long the drone hovered over sensitive assets (evidence of intent/surveillance).

Who Gets What? The Enforcement Split

Local/State Law Enforcement Federal (FAA / DOJ)
Their Focus The Pilot: Crimes happening now. The Aircraft: Rules of the sky.
What they want "Where is the person standing so I can talk to them?" "What is the drone's serial number and flight path?"
The Goal Stop trespassing, harassment, or "Peeping Tom" activity under state/local statutes. Issue fines ($75k+), revoke licenses, or press charges for airway obstruction, sabotage, or critical infrastructure interference.
Drone Detection System Data Live Pilot GPS, dwell time over windows/assets, and launch/land location. Remote ID, Serial Number, Altitude logs, and MAC address.

1. What to give Local Law Enforcement (The "Immediate Response")

When your security team calls 911 or dispatches local patrol, the officer doesn't care about "airspace classes." They care about Safety and Statutes.

The Information Packet:
The "Search Area": The exact GPS coordinates of where the pilot is standing right now. (This is the #1 most important thing a detection system provides).
The Violation: Tell the officer: "The operator is in violation of [State Statute] for flying over Critical Infrastructure" or "The operator is using the drone for illegal surveillance of our control room."
The Threat Level: Is the drone hovering over high-voltage equipment? Is it a persistent "snooper"?

2. What to give the FAA (The "Investigative Follow-up")

You typically don't call the FAA while the drone is in the air. You report the incident to the FAA Regional Operations Center (ROC) or a LEAP (Law Enforcement Assistance Program) agent after the fact.

The Information Packet:
The "Digital License Plate": The Remote ID and Serial Number captured by your sensors. This allows the FAA to look up the pilot’s name and address in their database.
The Flight Logs: A PDF export showing the drone’s altitude and 3D path. (e.g., "The drone flew at 100ft AGL, violating the rule to stay 400ft away from critical infrastructure.")
Registration Status: Your report helps the FAA determine if the drone was even registered (it’s a federal crime if it isn't).

FAA Best Practices and ROC Contact Info:

More Info on Remote ID:

Utilities Airspace Defense Who to Call

The "When" of Reporting: Strategic Timelines

A common mistake for security teams is trying to contact the FAA while the drone is still in the air. To ensure the best result, your security operations center should follow this reporting timeline:

1. Immediate (Real-Time): Call Local Law Enforcement

If the drone is currently in your airspace, your only call should be to local patrol or 911.

The Goal: "Soft Mitigation" (standing next to the pilot to de-escalate and safely land the drone).
The Data: Provide the Live Pilot GPS and the specific State Statute being violated.

2. Follow-Up (Within 24-48 Hours): Report to the FAA

Once the immediate threat is over and the pilot has been identified or has left the area, you pivot to federal enforcement. You should report to the FAA Regional Operations Center (ROC) or your assigned LEAP (Law Enforcement Assistance Program) agent if:

A Law was Broken: The drone flew over "Section 2209" protected infrastructure or violated Remote ID requirements.
Safety was Compromised: The drone flew dangerously close to energized equipment or interfered with utility personnel.
The Pilot was Identified: If local police issued a citation or conducted a field interview, the FAA needs that police report number and the drone’s serial number to initiate federal civil penalties.

3. The "Paper Trail" Advantage

Even if the police do not catch the pilot, you should still report every detected incursion to the FAA.

Why?: It builds a federal "priors" list. If the same drone serial number is reported at five different substations across three counties, the FAA will escalate the case from a "nuisance" to a Criminal Investigative priority. Your detection data provides the forensic chain of custody they need to link these incidents.

Section 3: Scalability & Operational Feasibility of Detection Technologies

Modern drone detection leverages three primary technologies. However, for a distributed utility grid, the transition from 'technical possibility' to 'operational reality' is determined by two critical factors: financial scalability and data certainty.

1. Remote Identification (RID): The Scalable "Digital License Plate"

As of 2023, most drones are legally required to broadcast their ID, altitude, and the GPS location of the pilot.

Scalability: Because RID technology leverages the drone’s own broadcast protocols (Wi-Fi/Bluetooth), receivers are significantly more affordable. RID is the only technology that is financially feasible to deploy across a grid of hundreds of substations.
Forensic Power: It identifies the "Who" and "Where" with mathematical certainty, making it the preferred evidence for local law enforcement.

2. RF Spectrum Sensing: The High-Security Tier

This technology "listens" for raw radio signals between a controller and a drone, even if RID is not present.

The Barrier: While powerful, the cost per site is often prohibitive for grid-wide deployment. It is typically reserved for high-value "Tier 1" generation plants.

3. Radar: The False Positive Challenge

Radar uses active pulses to see physical objects. While a classic tool, it faces major hurdles in a utility environment:

The False Positive Problem: Radar cannot easily distinguish between a drone and a bird or wind-blown debris. In rural sites, this leads to "alarm fatigue," where security teams eventually ignore the system.
Environmental Clutter: Metal structures and high-tension wires create "multipath" reflections, often blinding radar or creating "ghost" targets.

Note on Visual Verification

Cameras are not included here as a primary detection technology and are deployed almost universally with radar to help mitigate false alarms. While video is useful for post-incident review, it can be grainy or obstructed. GPS telemetry and RF logs, however, provide the mathematical certainty required for legal prosecution.

A Tiered Strategy for Scalable Utilities Airspace Defense

The most effective utility security posture is not built with a single, expensive "silver bullet" technology. Instead, We recommend starting with Remote ID (RID) to establish a baseline of grid-wide visibility and then "layering in" more intensive technologies—like Spectrum Sensing or Radar—only at high-risk "Tier 1" sites where the specific threat profile justifies the added cost and complexity.

Conclusion: Taking Command of Your Airspace

In the age of the drone, we have learned a definitive lesson: there is no fence tall enough to protect a utility site. The traditional perimeter has been rendered obsolete. However, this shift doesn't mean your facility is vulnerable; it means your security strategy must evolve.

The Reality of Mitigation: A High-Stakes Last Resort

While physical mitigation is technically possible, it remains a high-risk last resort that can only be legally executed by authorized law enforcement agencies. Under federal frameworks like the SAFER SKIES Act, counter-UAS mitigation authority is strictly limited to certified public safety agencies—not private utility operators. Furthermore, a disabled drone becomes a "falling brick" that can cause severe mechanical damage or trigger catastrophic lithium-ion battery fires in energized equipment. If law enforcement does engage in mitigation at your facility, it also triggers a massive administrative burden, including mandatory 48-hour federal reporting to the DOJ and DHS.

Strategic Deterrence: Recognizing Pre-Incident Behavior

The true victory for a utility is not found in "winning a dogfight" in the sky, but in prevention through deterrence. Sophisticated physical attacks are rarely "cold starts"—they are preceded by reconnaissance flights designed to map assets, identify security camera blind spots, and measure response times.

By leveraging continuous drone detection technology, you move from reacting to single flights to identifying trends and anomalies through historical reporting.

Regulatory Alert: FAA Section 2209 Update (May 2026)

The FAA has recently released a Notice of Proposed Rulemaking (NPRM) regarding Section 2209, which outlines a formal process for critical infrastructure sites to petition for federal flight restrictions.

A key takeaway for utility providers is the proposed requirement for facilities to maintain digital logging capabilities for RID telemetry. Regardless of the final rule’s specific language, the trend is clear: federal enforcement will rely on objective, timestamped forensic data. Utility security teams should prioritize systems that can verify and log these broadcast messages to ensure eligibility for future federal protections.

Taking Command through Intelligence

By embracing an Operator-Centric model, you extend your perimeter miles beyond the physical fence line. With the precision of Remote ID and actionable telemetry, you gain the airspace awareness necessary to transform a silent potential threat into a documented, prosecutable event.

By pinpointing a pilot’s location in seconds, you strip away their anonymity and harden your site against future incursions. You aren't just watching the skies; you are taking command of them. By bridging the gap between detection and enforcement, you ensure the resilience of the grid and the safety of the communities you serve. The "fence" may have a limit, but with the right intelligence, your security doesn't have to.

Protect your airspace. Elevate your security.

https://aerodefense.tech/wp-content/uploads/2025/11/NEW-AeroDefense-Logo-WEBP-640x147.webp
AeroDefense offers a full range of drone/pilot detection, tracking and identification. Our products are developed and manufactured in the US. All products operate without the need for legal waivers.

ADDRESS
1000 Sanger Ave,
Suite 18
Oceanport, NJ 07757
PHONE
1-732-284-3853
SUPPORT
help@aerodefense.tech
SALES
sales@aerodefense.tech
https://aerodefense.tech/wp-content/uploads/2025/11/NEW-AeroDefense-Logo-WEBP-640x147.webp
AeroDefense offers a full range of drone/pilot detection, tracking and identification. Our products are developed and manufactured in the US. All products operate without the need for legal waivers.

ADDRESS
1000 Sanger Ave, Suite 18
Oceanport, NJ 07757
PHONE
1-732-284-3853
SALES
sales@aerodefense.tech
SUPPORT
help@aerodefense.tech

Copyright © 2026 AeroDefense

retarget script