The Global Drone Security Network #2
Streamed live on Sep 18, 2020
The Global Drone Security Network (GDSN) is the only event of its kind focusing on Cyber-UAV security, Drone Threat Intelligence, Counter-UAS, and UTM security.
View the full conference: https://youtu.be/vZ6sRr65cSk
FULL TRANSCRIPT: PART 2
These trained observers articulate that there was a unique arrangement in which a large drone seems to have been accompanied by a fleet of smaller ones. The number of UAVs range from two to sixteen approximately six feet in width, so sizable aircraft. Flight time between two and three hours, nighttime operations, flying grid light patterns – that’s a significant operation. So who was doing it? Military? Commercial? The answer according to the FAA is it was neither military nor commercial. All the military commands that they asked said “nope, was not us” and they went through I presume all the open waivers. They reached out to all the commercial operators in the region said “hey, was this you?” and according to the FAA it was not commercial or military, so we still don’t know. Another take home here is that if you’re a malicious actor there’s a lot of sort of noise going on in the environment that you might be able to hide within and that gets to the what is normal. If you’re not keeping up with the sort of evolution of the counter-UAS industry in the united states, it’s been quietly taking off. People are getting beyond visual line of sight waivers. People are now effectively and have been for months using UAVs for inspecting pipelines – the dirty, dull, and dangerous – as well as tracks and all sorts of things. The literature on the left side of the screen is from a vendor that sells UAVs into this space. They assert that some of these operations are better done at night and so there’s an excuse for having UAVs over critical infrastructure at night. There you have the VTOL UAV that they provide can fly up to 40 kilometers beyond visual line site and flight endurance of 88 minutes. Pretty powerful aircraft and it operates in a variety of weather conditions on the right there’s a quote that says more often than not operators hire contractors and some contractors often hire their own subcontractors. If you’re trying to figure out who’s actually flying over a site and you’ve got to work through all those legal layers of contracts. Good luck getting that done in a timely manner and it may be difficult to do even if you’ve got more time elsewhere. I showed you about where energy infrastructure is. I mentioned there’s a density down around Louisiana, the Mississippi River drains out there. There’s a lot of energy infrastructure in the Gulf itself, a lot of shipping coming in there. There’s a lot of energy infrastructure down there, including some apparently very rare chemicals coming out of it after the area was devastated by a hurricane. There was a lot of pressure to get certain refineries back up online as quickly as possible because some of the chemicals coming out of that region are apparently incredibly important in national security and that was the only source of it.
So, looking at what’s going on in Louisiana it makes a lot of sense if you’re trying to get a sense of what’s at risk and what’s creating that risk. Three Spanish males were arrested for flying UAV over Valero back in 2018. The second quote is a detective who, while they were on site at the Dow Chemical facility, observed a small UAV that was remaining stationary and rotating 360. So, not just flying through, not fly away, something was sitting there intentionally and doing what we would consider a surveillance sort of activity. One of the guys working on a different site had a UAV crash right in front of his truck. Could be fly away incident reports don’t get beyond the fact that this happened. France 2014, over flights of seven nuclear reactors. 2018, Greenpeace flew a drone dressed up like superman into a nuclear reactor demonstrating “hey, there’s a security problem here.” In the United States, there was a Mavic found next to a non-bulk electric substation with some ropes and then at the end of the ropes was copper wire, presumably could have been used for shorting out transformers and things like that. I’ve been asking for the picture of this and I’ve been told by multiple credible sources it exists. No one’s shared the picture of that with me if you have a copy of it feel free to send it to me anonymously or take credit for it. One way or another I’d love to see that one.
We talked about Saudi Arabia previous presentations and you can go look this up. It was the most significant attack on energy infrastructure to date and I think it’s reasonable soon then it’s not going to be the last.
What’s the risk? What’s creating the risk? What are the risks? What’s going on in the United States? We wanted to sort of categorize how big is the problem based and what are they doing. On the upper right, and this is something that the hobbyists get out of shape about for good reason, most people are compliant. The vast majority of people flying in the United States we believe are compliant. They’re staying below the thresholds, they’re flying in the proof of locations, they’re getting the right waivers, they’re registering and things like that. Unfortunately, there’s not sufficient amount of data to prove any of this but it’s a these are all reasonable assumptions. I think the vast majority of these people are compliant. Below that there’s a smaller number of people who are just careless. They kind of know what’s going on but they’re not paying attention. They go too high; they fly over somebody’s property. These people are still not a real big threat – it’s just they’re going to create attention and that’s not good for any of us, particularly the people who are being compliant. There’s the clueless – these people haven’t registered with the FAA, they don’t know that there are regulations in place, and they’re just going to do whatever they want. The threat they’re creating is still relatively small. They’re not flying with malicious intent; they’re just being stupid. Now we’re getting down to the people who create some amount of risk. These are the thrill seekers who are continuously pushing the boundaries, intentionally flying through their space. They don’t mean harm, but they don’t understand the harm that they can potentially do by what they’re doing but also the harm they’re doing to the entire industry. There are videos of people flying Mavics above the clouds and the cloud deck at that location was 8000 feet plus, so they are well out of visual line of sight. It’s a beautiful picture and they keep doing this and they keep pushing the envelope. This sort of activity we need to clamp down on unfortunately but they’re still not the people that are going to pose a threat to the energy infrastructure. Now we’re talking criminal and terrorists – these are the smallest number of actual operations, but they are posing the greatest threat. You can produce your own threat matrix, and I encourage you to do so, if you are responsible for protecting a facility. One other take home from this threat matrix is getting lost in the noise, the terrorists and the criminals are going to be the very small number of overall flights and if those terrorists and criminals can look like a legitimate flight or just somebody’s clueless or careless that gives them additional cover that they can use for accomplishing their particular goals.