Utilities Airspace Defense Playbook

How utility operators can shift from watching the skies to identifying the pilot, turning drone detection data into prosecution-ready evidence.
Executive Summary
Section 1: The Ground Game
CIP StatutesTrespass & PrivacyHarassment & StalkingLaunch & RecoveryReckless EndangermentNational Security ListState Enforcement Examples
Section 2: Incident Reports
Digital Evidence PackageThe Enforcement SplitWhat to Give Local Law EnforcementWhat to Give the FAAReporting Timeline
Section 3: Scalability
Remote IDRF Spectrum SensingRadarVisual VerificationA Tiered Strategy
Conclusion
The Reality of MitigationRegulatory AlertTaking Command

Executive Summary

For utility providers, from large substations to power generation plants, Unmanned Aircraft Systems (UAS), more commonly known as drones, are no longer just a potential threat. They pose a real security risk, allowing operators to capture detailed aerial footage and bypass traditional perimeter fencing.
For utility operators, the biggest threat is intentional sabotage that can cause widespread power outages. However, a more common risk comes from careless hobbyists. As recreational drone use grows, more drones are flying near utility sites without their operators understanding the rules or risks. Whether someone is deliberately surveying a transformer bank or simply flying too close for a photo, both situations pose serious risks to critical infrastructure.
The essential shift is moving your focus from the aircraft to the operator.
While the Federal Aviation Administration (FAA) regulates the airspace, state and local authorities enforce laws on the ground. By identifying and locating the pilot, you give local law enforcement the information needed to act. Instead of focusing on stopping the drone, the goal is to identify the person who may be violating state trespassing or critical infrastructure laws.
This guide explains how to use drone detection systems to document incidents, build prosecution-ready reports, and support enforcement using applicable state and local laws, including Critical Infrastructure Protection (CIP), privacy, and trespassing laws.
By turning detection data into actionable evidence, utility operators can move from passive observation to active enforcement and prevention.

Section 1: The Ground Game: Leveraging State and Local Laws for Drone Incursions

The Federal Aviation Administration (FAA) regulates airspace and drone operations, while state and local authorities can enforce applicable laws governing an operator's conduct. For utility providers, six legal approaches may help address drone-related incidents.
However, these laws require evidence to support enforcement. A visual drone sighting may raise concerns, but documented flight data can provide stronger support for an investigation. Drone detection systems help bridge this gap by recording available information, such as GPS coordinates, identification data, timestamps, and flight paths. Section 3 explores these technical capabilities in detail. First, let's examine the legal frameworks they can support.
1.

Critical Infrastructure Protection (CIP) Statutes

Many states have laws restricting certain drone activities near designated critical infrastructure, including power plants, substations, and water facilities.
The Law
Depending on the state, unauthorized surveillance, interference, or certain drone operations involving protected facilities may constitute an offense. Restrictions and exemptions vary by jurisdiction.
How to Use It
Your detection system can document drone location, altitude, and flight history to help determine whether an operation may have violated applicable restrictions. This information gives law enforcement evidence to review when investigating potential violations.
2.

Potential Criminal Trespass & Privacy Violations

While the FAA regulates U.S. airspace, utilities may have legal protections against certain low-altitude drone activities, surveillance, or interference under state and local laws.
The Law
Many states restrict drone-based surveillance, trespassing, and other unauthorized activities under specific circumstances. Violations may depend on operator intent, proximity to protected assets, and the nature of the activity.
How to Use It
Documented drone activity can support security investigations and coordination with law enforcement when flight behavior suggests unauthorized reconnaissance, surveillance, or interference near utility infrastructure.
3.

Harassment & Stalking

Repeated drone activity targeting a facility or its employees may raise concerns beyond an isolated incident.
The Law
Repeated drone operations directed at individuals, particularly after warnings, may fall under harassment, stalking, or related laws depending on the jurisdiction and circumstances.
How to Use It
Your system's historical data can help establish patterns of activity. For example, records showing the same drone identifier appearing near a substation several times in one week may provide useful evidence for a law enforcement investigation.
4.

Launch and Recovery (The Ground-Control Lever)

While the FAA regulates drone flight, state and local laws may govern where operators can physically launch, land, or operate their drones.
The Law
On-Property: Entering restricted utility property without authorization may constitute criminal trespass. Additional critical infrastructure protections may apply depending on the location and circumstances.
Off-Property: If a pilot operates from nearby public property, such as a municipal park, local restrictions on launching or landing drones may apply. These rules vary by municipality and must be consistent with federal law.
How to Use It
When available, pilot or control-station location data can help security teams determine whether an operator may be on restricted property or operating from an area subject to local restrictions.
If the location suggests a potential violation, share the documented information with internal security or local law enforcement for further investigation.
5.

Reckless Endangerment (The Public Safety Lever)

Drone operations near high-voltage equipment may create serious safety risks, even when the operator does not intend to cause damage.
The Law
Reckless endangerment laws may apply when an individual's conduct creates a legally defined risk of injury to others. The requirements differ by state.
How to Use It
Recorded flight paths and altitude data can help document how close a drone came to sensitive equipment, such as transformers or energized conductors. This evidence can support an investigation into whether the operation created a significant public safety risk.
6.

National Security Covered List (2026 Update)

Recent Federal Communications Commission (FCC) updates have introduced additional national security considerations involving certain foreign-produced drone systems and components.
The Law
The FCC's Covered List identifies equipment and services considered to pose national security risks. Restrictions primarily affect equipment authorization and market access. Inclusion on the list does not automatically make operating a previously authorized drone illegal.
How to Use It
Where supported, drone identification data can help security teams document the aircraft involved in an incident. If suspicious activity near critical infrastructure raises broader security concerns, this information can support coordination with appropriate federal authorities, including the FBI or Department of Homeland Security (DHS).

State Enforcement Examples

State
Primary Statute
Utility Application
Texas
Gov. Code § 423.0045
Felony to fly over "Critical Infrastructure" facilities.
Florida
FS § 934.50
Prohibits unauthorized surveillance; allows for civil lawsuits.
Arizona
Rev. Stat. § 13-3729
Specifically prohibits loitering or photographing near critical facilities.
Tennessee
TN Code § 39-13-903
Class E Felony to fly within 250ft to conduct surveillance.
Louisiana
R.S. 14 §337
Prohibits unauthorized surveillance, data collection, or recording of critical infrastructure.
Arkansas
AR Code § 5-60-103
Prohibits gathering evidence or recording critical infrastructure.
Michigan
HB 5319
Criminalizes hovering over or trespassing on critical infrastructure.
Oklahoma
HB 2599
Civil liability for damages; prohibits flights below 400ft.
Important Note for Security Directors
This playbook is for educational and informational purposes only and does not constitute legal advice. State and local drone laws vary by jurisdiction and continue to evolve. Utility operators should consult corporate legal counsel and local law enforcement to identify applicable regulations and appropriate enforcement procedures. AeroDefense provides drone detection technology and does not offer legal advice or guarantee enforcement outcomes.

Section 2: The Anatomy of an Actionable Incident Report for Utilities Airspace Defense

Law enforcement and the FAA increasingly rely on Radio Frequency (RF) telemetry because it is objective, timestamped, and difficult for a pilot to refute. Data is more durable than video. When the "detect" alarm sounds at a substation, the goal is to generate a report that an officer can act upon immediately. Drone detection systems automate this by compiling a Digital Evidence Package.
The "Who" (Pilot & Aircraft ID)
Remote ID & Serial Numbers: Unique identifiers that link the drone to its registered owner.
Pilot GPS Coordinates: The exact location of the operator. This is the most critical data point for a patrol officer.
The "Where" (Geofence Breach Documentation)
Altitude & 3D Flight Path: Proves the drone flew low enough to threaten equipment or cause a nuisance.
Dwell Time: Documentation of how long the drone hovered over sensitive assets (evidence of intent/surveillance).

Who Gets What? The Enforcement Split

Local/State Law Enforcement
Federal (FAA / DOJ)
Their Focus
The Pilot: Crimes happening now.
The Aircraft: Rules of the sky.
What they want
"Where is the person standing so I can talk to them?"
"What is the drone's serial number and flight path?"
The Goal
Stop trespassing, harassment, or "Peeping Tom" activity under state/local statutes.
Issue fines ($75k+), revoke licenses, or press charges for airway obstruction, sabotage, or critical infrastructure interference.
Drone Detection System Data
Live Pilot GPS, dwell time over windows/assets, and launch/land location.
Remote ID, Serial Number, Altitude logs, and MAC address.
1.

What to Provide Local Law Enforcement (The "Immediate Response")

When a security team contacts 911 or local law enforcement about an active drone incident, responding officers need clear information about the potential safety threat and applicable state or local laws.
Federal airspace classifications may be relevant, but the immediate priority is identifying the operator and determining whether a violation is occurring.
The Information Packet:
  • Pilot Search Area: Provide the exact GPS coordinates identifying where the pilot is currently located. This is one of the most important pieces of information a drone detection system can provide during an active incident.
  • Potential Violation: Identify the applicable state statute and explain the suspected violation, such as flying over protected critical infrastructure or conducting illegal surveillance of a utility control room.
  • Threat Level: Describe the drone's behavior, including whether it is hovering over high-voltage equipment or repeatedly approaching sensitive areas.
How to Use It
Share real-time pilot location information and the relevant state statute with responding officers. This allows law enforcement to locate the operator, assess the situation, and take appropriate action.
2.

What to Provide the FAA (The "Investigative Follow-up")

While local law enforcement handles immediate security concerns, the FAA investigates potential violations of federal aviation regulations.
Utility operators typically report these incidents to the FAA Regional Operations Center (ROC) or a Law Enforcement Assistance Program (LEAP) agent after the drone is no longer in the air.
The Information Packet:
  • Remote ID and Serial Number: Identification information captured by your detection system allows the FAA to look up the pilot's name and address in its database.
  • Flight Logs: Provide a PDF export documenting the drone's altitude and 3D flight path. For example, records may show a drone flying at 100 feet above ground level (AGL), violating a requirement to remain 400 feet away from critical infrastructure.
  • Registration Status: Detection reports help the FAA determine whether the drone was properly registered. Operating an unregistered drone when registration is required constitutes a federal offense.
How to Use It
Preserve the recorded flight information and submit it to the FAA through the appropriate reporting channels. These records can support investigations into potential aviation violations and enforcement actions.
FAA Reporting Resources
FAA Drone Response CardA Quick Guide to Remote ID

The "When" of Reporting: Strategic Timelines

An effective response requires coordinating with the appropriate authorities at the right time. Rather than contacting the FAA while a drone is still in the air, utility security teams should prioritize immediate local response and follow up with federal authorities once the incident has been addressed. The following reporting timeline provides a practical framework for utility security operations.
1
Immediate Response: Contact Local Law Enforcement
When a drone is actively operating near protected utility infrastructure, contact local law enforcement or 911.
The Goal
Support safe de-escalation by helping officers locate the pilot, address the activity, and have the drone landed without physical interference.
The Data
Provide live pilot GPS coordinates and identify the specific state statute that may have been violated.
2
Follow-Up: Report to the FAA Within 24–48 Hours
Once the immediate threat is over and the pilot has been identified or has left the area, you pivot to federal enforcement. Report to the FAA Regional Operations Center (ROC) or your assigned LEAP agent if:
A Federal Law Was Violated
The drone flew over infrastructure protected under Section 2209 or violated Remote ID requirements.
Safety Was Compromised
The aircraft operated dangerously close to energized equipment or interfered with utility personnel.
The Pilot Was Identified
Local police issued a citation or conducted a field interview. The FAA needs the police report number and drone serial number to initiate federal civil penalties.
3
The "Paper Trail" Advantage
Even if the police do not catch the pilot, you should still report every detected incursion to the FAA.
Why? It builds a federal "priors" list. If the same drone serial number is reported at five different substations across three counties, the FAA will escalate the case from a "nuisance" to a Criminal Investigative priority. Your detection data provides the forensic chain of custody they need to link these incidents.

Section 3: Scalability & Operational Feasibility of Detection Technologies

Modern drone detection leverages three primary technologies. However, for a distributed utility grid, the transition from 'technical possibility' to 'operational reality' is determined by two critical factors: financial scalability and data certainty.
1.

Remote Identification (RID): The Scalable "Digital License Plate"

As of 2023, most drones are legally required to broadcast their ID, altitude, and the GPS location of the pilot.
Scalability
Because RID technology leverages the drone’s own broadcast protocols (Wi- Fi/Bluetooth), receivers are significantly more affordable. RID is the only technology that is financially feasible to deploy across a grid of hundreds of substations.
Forensic Power
It identifies the "Who" and "Where" with mathematical certainty, making it the preferred evidence for local law enforcement.
2.

RF Spectrum Sensing: The High-Security Tier

This technology "listens" for raw radio signals between a controller and a drone, even if RID is not present.
The Barrier
While powerful, the cost per site is often prohibitive for grid-wide deployment. It is typically reserved for high-value "Tier 1" generation plants.
3.

Radar: The False Positive Challenge

Radar uses active pulses to see physical objects. While a classic tool, it faces major hurdles in a utility environment:
The False Positive Problem
Radar cannot easily distinguish between a drone and a bird or wind-blown debris. In rural sites, this leads to "alarm fatigue," where security teams eventually ignore the system.
Environmental Clutter
Metal structures and high-tension wires create "multipath" reflections, often blinding radar or creating "ghost" targets.

Note on Visual Verification

Cameras are not included here as a primary detection technology and are deployed almost universally with radar to help mitigate false alarms. While video is useful for post-incident review, it can be grainy or obstructed. GPS telemetry and RF logs, however, provide the mathematical certainty required for legal prosecution.

A Tiered Strategy for Scalable Utilities Airspace Defense

The most effective utility security posture is not built with a single, expensive "silver bullet" technology. Instead, we recommend starting with Remote ID (RID) to establish a baseline of grid-wide visibility and then "layering in" more intensive technologies—like Spectrum Sensing or Radar—only at high-risk "Tier 1" sites where the specific threat profile justifies the added cost and complexity.

Conclusion: Taking Command of Your Airspace

In the age of the drone, we have learned a definitive lesson: there is no fence tall enough to protect a utility site. The traditional perimeter has been rendered obsolete. However, this shift doesn't mean your facility is vulnerable; it means your security strategy must evolve.

The Reality of Mitigation: A High-Stakes Last Resort

While physical mitigation is technically possible, it remains a high-risk last resort that can only be legally executed by authorized law enforcement agencies. Under federal frameworks like the SAFER SKIES Act, counter-UAS mitigation authority is strictly limited to certified public safety agencies—not private utility operators. Furthermore, a disabled drone becomes a "falling brick" that can cause severe mechanical damage or trigger catastrophic lithium-ion battery fires in energized equipment. If law enforcement does engage in mitigation at your facility, it also triggers a massive administrative burden, including mandatory 48-hour federal reporting to the DOJ and DHS.
More on the SAFER SKIES Act.

Regulatory Alert: FAA Section 2209 Update (May 2026)

The FAA has recently released a Notice of Proposed Rulemaking (NPRM) regarding Section 2209, which outlines a formal process for critical infrastructure sites to petition for federal flight restrictions.
A key takeaway for utility providers is the proposed requirement for facilities to maintain digital logging capabilities for RID telemetry. Regardless of the final rule’s specific language, the trend is clear: federal enforcement will rely on objective, timestamped forensic data. Utility security teams should prioritize systems that can verify and log these broadcast messages to ensure eligibility for future federal protections.
Additional Resources
FAA Section 2209 Fact SheetFAA Drone Restrictions for Critical Infrastructure

Taking Command Through Airspace Intelligence

By embracing an Operator-Centric model, you extend your perimeter miles beyond the physical fence line. With the precision of Remote ID and actionable telemetry, you gain the airspace awareness necessary to transform a silent potential threat into a documented, prosecutable event.
By pinpointing a pilot’s location in seconds, you strip away their anonymity and harden your site against future incursions. By bridging the gap between detection and enforcement, you ensure the resilience of the grid and the safety of the communities you serve.
You aren’t just watching the skies; you are taking command of them.

Find the Right AirWarden Solution

Get expert guidance to compare options and choose the right AirWarden solution for your site, security needs, and budget.
Contact Us