I Fly, I Can Spy, and I Can Collide

Lightweight remotely piloted aircraft systems (RPAS), already widely available as low cost commercial and hobbyist products, are posing new security challenges for Australian aviation and law enforcement policy makers.

By Joe Urli, Brad Mason and Peter La Franchi

The capacity of remotely piloted aircraft systems (RPAS) to support domestic law enforcement and security applications is widely recognised as an important emerging focal point for capability planners in Australia as well as internationally. There is a darker side to that outlook however, the rising domestic security challenge of unregulated RPAS being fielded the specific intent to conduct illegal operations that range from outright acts of delinquency to criminality and terrorism.

Lest the use of RPAS in such dark ways be considered speculative, consider this: There is already legislation in place in Queensland banning the use of RPAS and hobbyist radio control model aircraft in the designated security zones being established for the conduct of the Group of Twenty (G20) summit in Brisbane in mid-November this year. The basis for that ban is obvious if the parameters of RPAS technology are understood: a proficient operator fielding an $800, four-rotor multicopter with a video camera could track a given diplomatic official from his hotel to the conference venue with the imagery helping perfect an assassination attempt. Another proficient operator, using an $8,000, eight-rotor commercially available RPAS could carry a small improvised explosive device and fly it into a selected diplomat’s car even as it sped down a Brisbane motorway.

Nor is the capacity to use commercially available UAS as a threat system restricted in any sense just to high profile diplomatic gatherings. These readily available commercial products are in fact already a very real problem from a variety of perspectives. At the end of June this year, security guards in Dublin, Ireland, discovered a crashed hobbyist-grade RPAS in a prison exercise yard; the user is believed to have been attempting to deliver contraband. Three months earlier, Victorian police arrested a man flying a hobbyist RPAS near the Melbourne metropolitan remand centre, with charges including possession of a drug of dependence.

In October 2013 a visitor from the United Kingdom flew his hobbyist grade system, brought into the country in his suitcase, around the Sydney Harbour Bridge under the cover of darkness. The RPAS crashed onto the railway lines on the Western side of the bridge deck and briefly sparked a reaction from Sydney-based counter terrorism unit. The RPAS operator was later fined by the Australian Civil Aviation Safety Authority (CASA), one of the few instances of prosecution that has occurred in Australia despite the regulator frequently acknowledging it does not have the resources to effectively monitor and oversee the breadth of this important and rapidly growing segment of aviation.

CASA’s solution, made public in May this year in the form of a proposed change to Australian aviation regulations, is the complete removal of regulatory oversight of RPAS below 2kg in weight unless they are being used for commercial purposes. Such small systems, CASA argues, are unlikely to be capable of causing harm or incidents and should therefore be treated as an evolved form of model aircraft. The proposal has generated widespread concern within the Australian aviation community, linking organisations ranging from the Australian Certified UAV Operators Association, the Australian Airports Association and the Aerial Agricultural Association of Australia in a common position of opposition.

Small Things, Big Impacts

The need for effective and common security structures as part of ensuring the safety of the global air navigation has been an essential feature of national and international air law since the 1944 Chicago Convention. The place of all forms of RPAS in that global regulatory structure is still in a state of flux, however CASA’s proposed deregulation is unique in global terms. There is no other national aviation regulatory authority in the world seeking to remove an entire class of aircraft from its oversight and indeed, if the example of the United States is considered, the Federal Aviation Administration (FAA) is seeking to expand and enhance its controls over the small RPAS segment at a broad level, even as it also moves to facilitate commercial applications.

Can lightweight and hobbyist grade RPAS pose a specific and credible threat to aviation safety? In November 2013, a hobbyist flew a small RPAS over the final approach flight path into Vancouver International airport, filmed a commercial airliner flying just beneath it, and then posted the video to YouTube. In May this year a commercial airliner landing at Perth airport in Western Australia had to take evasive action at 3800ft altitude because an RPAS was flying in its path. On 30 June 2014, Canadian police launched an investigation of yet another incident involving yet another RPAS incursion at Vancouver International. In the United States, the FAA is investigating a series of critical incidents involving near misses near airports, the most recent being an American Airlines flight almost colliding with a RPAS on final approach in regional Florida. While the RPAS in each case were small, ingestion of the system into an aircraft engine at a critical phase of flight could cause a major crisis, and a $500 hobbyist RPAS can easily fly to altitudes of several thousand feet for tens of minutes.

CASA itself released a study in early June 2014 which assessed the potential damage that a small RPAS could cause to an airliner, with this acknowledging significant damage could result in an engine ingestion scenario. The study also cautioned the regulator that more research, including trials looking at issues such as the likely consequences of a lightweight RPAS striking the windshield of a general aviation aircraft were required before any definitive safety decisions could be made. CASA has not actioned that recommendation despite its deregulation push.

While these near airport safety incidents appear largely to be the result of hobbyists flying in ignorance of aviation regulations and with common sense set aside, they flag the possibility of a more significant problem, with security at its core. Consider a scenario where multiple small systems are intentionally placed in the flight path of an airliner. To bring down a passenger flight as it closes in to land at Brisbane International, imagine a swarm of 50 modified hobbyist-category RPAS, each no more than 2kg in weight and launched from multiple park and backyards under the primary south-southwest approach. Each RPAS is programmed to fly by different routes to arrive at the same time at a single waiting point directly inside that main flight path, perhaps 8-10km from the start of the runway. At this point a descending airliner is flying at speeds of around 170kt and is at an altitude of below 3000ft. The actual skills necessary to coordinate multiple systems to a single point in the sky is well within the grasp of most recreational RPAS flyers today. Optimising the timing for the launch of the swarm could be as simple as using a live flight tracking program from the internet, these using aircraft ADS-B transmissions to provide highly accurate positional data for individual commercial aircraft. Terminal phase precision aiming of the swarm could be achieved by using commercially available ‘First Person View (FPV) flying modes for designated ‘leader’ RPAS modified to act as a virtual homing beacon for other units. One leader RPAS is flown in FPV directly towards an airliner engine intake, and half the swarm follows in milliseconds. A second operator uses another leader RPAS to take out a second engine with the remainder of the swarm.

Would such a strike be detectable in its critical convergence phase by extant sensors aboard an aircraft or by air traffic control radar? For a commercial airliner the answer is clearly no, nor would air traffic control likely detect the converging RPAS because of their small size as well as their separation during all but the final seconds of flight. For a military or modified state aircraft, nose mounted radar or an imaging sensor may provide some warning but only in the final seconds of swarm convergence, directly before the commencement of impacts. The total cost of equipment needed to mount such a terrorist action could be as low as $100,000 using nothing more than adapted existing commercial products. The lead time for a technically proficient, hostile actor to create and ready such a swarm can be reasonably estimated at less than tens of weeks. This is not an argument for outright banning of all forms of RPAS, which would be a retrograde and economically harmful step, but rather a clear pointer towards an intelligent regulatory structure of far greater sophistication than we see today.

Blurred Lines

The extant challenge of hobbyist RPAS operators flying near airports has already seen one major manufacturer, the Chinese-based Dajiang Innovation Technology (DJI) company, introduce firmware restrictions in the autopilots of its most popular product, the Phantom II. This firmware, rolled out in early 2014, creates GPS-defined ‘no fly zones’ around major airports on all continents if the RPAS is being flown in GPS navigation mode. Within 2.4km of an airport the feature prevents a Phantom II from being able to take off at all. At 2.5km from the airport the firmware allows the UAS to fly but to a maximum altitude of 35ft. As the user moves further from the airport, that height ceiling is progressively raised, to peak at 400ft at a distance of 8km. The firmware also restricts the default height ceiling to 1300ft and the maximum distance of the RPAS from the operator to 1.6km. DJI explained the new firmware to its user community, which is huge in both the USA and Australia, as a reaction to multiple air safety regulator warnings that hobbyist RPAS users could not be relied upon to demonstrate safe operational practices as defined by respective national aviation codes.

The DJI solution can be considered partially workable for the closed architecture, consumer grade systems which the company produces, and can be anticipated to have a positive impact on compliance of non-expert hobbyists with air safety regulations as long as the feature is actually switched on. A Phantom II can also be flown in what is called ‘atti’ or wholly manual mode which disables the automatic no fly restrictions. However, the closed architecture of the Phantom II also means it is unlikely to be the RPAS of choice for any actor interested in stepping outside the bounds of aviation regulations. The global market is awash with open source autopilots, developer code and do-it-yourself RPAS kits and components. Even DJI offers pick and choose hardware elements which more technically adept users can draw upon to create their own tailor-made systems, many of which have further evolved to become commercial systems in their own right. DJI’s ‘no fly zone’ precedent, in this regard, is inherently limited as a functional technical solution.

Australia’s existing regulations for RPAS, comprising Part 101 of the Civil Aviation Safety Regulations (CASR), seek to tightly bind operators, whether hobbyist or commercial. Part 101 seeks to distinguish RPAS from model aircraft in general, with this an important element of ensuring that hobbyists are not subject to unnecessary or onerous regulatory provisions. CASA has long regulated the Australian model aircraft sector via the delegation of administrative authority to the Model Aeronautical Association of Australia (MAAA). Common CASA and MAAA definitions holds that a model aircraft is one that is flown by remote control and solely for the purposes of sport of fun. Traditionally, model aircraft are flown by manual means, within visual line of sight of the pilot at all times. Standing MAAA guidance defines model aircraft as being without autopilots, INS, IMU or any form of flight control or flight navigation system and as such, command a fair degree of pilot proficiency to control them and fly them safely. The emergence of low cost autopilots however, has shifted the very nature of that definition, with even the most basic hobbyist RPAS now featuring quite sophisticated pilot automation capabilities that allow a complete novice to fly one well beyond visual sight. Some so-called hobbyist RPAS even feature waypoint based navigation using an Apple iPhone as the command display. All multicopter types require a flight control system if they are to fly and even if being operated purely for fun or sport, such systems no longer fit established definitions of a model aircraft. Commercial information technology developments have effectively shifted the parameters of the sector far beyond what extant regulations can reasonably handle, and that mixed status does little to help resolve the parameters of meaningful regulations as a whole. Taken wider, this blurring presents a significant challenge to security planners. So common is it becoming today, to see someone flying a recreational RPAS in a city or suburban environment, that the public would be hard pressed to distinguish the harmless model aircraft operator from the committed terrorist.

That blurring, in the context of the Queensland Government G20 ban on RPAS and model aircraft, raises other challenges. The Queensland bill was enacted in October 2013 and came as a surprise to the Australian commercial RPAS sector and the wider model aircraft community. There was no prior consultation by the Queensland Government, nor has there been any subsequent attempt by any Queensland state entity to explain the parameters of the bill and how it will be enforced. There are hundreds of small RPAS like the Phantom II in the hands of hobbyists across the greater Brisbane area, and widespread knowledge of the G20 ban cannot be assumed by Queensland law enforcement authorities. On the other hand, there is widespread awareness of and support for the proposed deregulation of the sub-2kg class of RPAS amongst model aircraft enthusiasts. Encouraged by CASA’s proposals, the foreshore parklands of the Brisbane River as its flows through the city centre area are already a popular flight zone for lightweight RPAS, and the potential for ‘innocent incidents’ being met by disproportional reactions during the G20 must therefore be regarded as high.

Finding Forward Directions

Given that the fundamental parameters upon which CASR Part 101 have been superseded by technology, it is well time for an intelligent and well-structured review of Australia’s regulatory framework for all forms of RPAS as well as model aircraft. The spectrum of capabilities and applications which can be facilitated by this technology, and the policy and regulatory challenges they pose require the combined attention of not just CASA, model aircraft enthusiasts with the many commercial and emerging public sector users of RPAS, but also law enforcement and public safety agencies.

RPAS are a technology of immense significance to Australia’s aviation future, and while the current regulatory structures have their limitations, they are allowing an important national industry to develop. The next iteration of those regulatory structures must be, like the original Part 101, far sighted and innovative. CASA has been right to launch a review of Part 101 in this regard, however its push for a rapid, across the board deregulation of systems which have clear capacity to pose new safety and security challenges is short sighted. That deregulation drive should now be set aside, and a more involved process of review initiated. More voices are needed at the table, coupled with more detailed safety and security analysis. The future regulatory structures need to be based on evidence, and with more than 100 certified commercial RPAS operators now approved by CASA, there is sufficient weight of capacity to generate the requisite underpinning data. Finally, noting that given CASA itself has only limited resources available to oversee its RPAS responsibilities, it would be appropriate for any more substantive process of review to proceed as combined initiative of the Federal Department of Infrastructure and Regional Development and the Federal Attorney Generals Department.

On Terminology

The terms ‘Unmanned Aerial Vehicle’ (UAV), ‘Unmanned Aircraft System’ (UAS), ‘Remotely Piloted Aircraft System’ (RPAS) and ‘Drone’ are, in the broad, all references to one and the same thing, this being: “An aircraft (or aircraft-system) that is flown from a remote location without a pilot located in the aircraft itself.”

‘UAV’ was the original term adopted for regulatory application by CASA in July 2002 and is still widely in use including much of CASA certification, licencing and guidance material. This term predominated at the time of the formation of the Australian Certified UAV Operators and its legal incorporation. ‘UAS’ is the more up-to-date internationally accepted term in use today, with this now recognised as the overarching ‘class’ terminology by the International Civil Aviation Organisation (ICAO) as well as by CASA. ‘RPAS’ is defined by ICAO as a form of UAS which is non-autonomous in its capacities, the aircraft being subject to direct pilot control at all stages of flight despite operating ‘remotely’ from that pilot. CASA has recently shifted to use of the term RPAS as its primary day to day terminology.

‘Drone’ historically refers to a military UAS which exists to act as a target for live-fire air defence weapons training by armed forces with this remaining the correct terminological reference. Popular culture uses the term as a generic descriptor for all classes of unmanned or remotely piloted aircraft, but particularly in relation to military systems with weapons carriage capabilities. Drone has no status as a legal term in any CASA or ICAO regulatory document. Ironically, the Queensland G20 legislation referenced by this article uses the term ‘drone’ and in doing so has created a terminological discrepancy not supported by overarching national aviation regulations.

Author notes: Joe Urli is the President of the Australian Association of Commercial UAV Operators (ACUO). He is a CASA certified commercial operator and heads the Brisbane-based UAV Systems company. Brad Mason is the Secretary of ACUO and was the first CASA certified commercial RPAS operator in Australia. Peter La Franchi is an internationally recognised unmanned systems business and policy analyst.