New rules will keep unmanned aircraft away from prisons and power plants

The Federal Aviation Administration (FAA) has published a notice of proposed rulemaking (NPRM) to establish a regulatory process for operators and proprietors of fixed site facilities to request unmanned aircraft flight restrictions (UAFRs). The proposed rule implements section 2209 of the FAA Extension, Safety, and Security Act of 2016, which was subsequently amended by the FAA Reauthorization Act of 2018 to include railroad facilities, and the FAA Reauthorization Act of 2024 to include state prisons. The legislation mandates the FAA to balance the rapid proliferation and integration of unmanned aircraft systems (UAS) with the necessity of mitigating security and safety risks to critical infrastructure. In recent years, malicious or careless drone flights have posed a growing threat to public safety, including incidents of espionage over chemical plants, interference with electrical substations and the smuggling of contraband into prisons. Consequently, the FAA proposes a framework to restrict unmanned aircraft in close proximity to critical assets, provided the applicant can demonstrate the restriction is necessary for aviation safety, homeland security, national security or the protection of people and property on the ground.

The proposal delineates two distinct airspace designations: the standard UAFR and the special UAFR. A standard UAFR outlines specific horizontal and vertical limits within which unauthorised unmanned aircraft operations are restricted. The lateral boundaries must fall entirely within the applicant’s property lines, while the vertical altitude ceiling is generally capped at 400 feet above ground level. However, if the tallest structure within the lateral boundary exceeds 300 feet, the ceiling can extend to the structure’s height plus 100 feet, rounded up to the nearest 50-foot increment. Crucially, the UAFR does not authorise a facility to deploy counter-UAS technologies to intercept or destroy drones; rather, it creates a legal boundary that enables law enforcement to distinguish between lawful and unlawful operations. UAFRs can be either continuous, remaining active 24 hours a day year-round, or part-time, remaining active 24 hours a day for up to 290 consecutive days a year to accommodate seasonal operations.

In contrast, a special UAFR is designed for sensitive federal sites and certain eligible fixed site facilities where a credible safety or security threat exists. These restrictions apply to facilities owned or endorsed by federal security agencies, intelligence agencies or military departments. Special UAFRs aim to strictly limit routine UAS overflight and establish a longer-term, five-year designation to address persistent threats, offering a permanent alternative to the short-term special security instructions currently issued under 14 CFR 99.7. By integrating existing 99.7 restrictions into the special UAFR framework, the FAA provides a cohesive and uniform standard for managing airspace security. Access to a special UAFR is highly restricted; operations within this airspace require explicit permission from both the using agency responsible for the site and the FAA administrator.

The necessity of these restrictions is underscored by the unique vulnerabilities each critical infrastructure sector faces. In the commercial facilities sector, unmanned aircraft operating too close to high-speed rides at amusement parks could strike people or infrastructure, while unchecked surveillance could expose ride control systems to cyber-attacks. The chemical sector faces threats from malicious actors exploiting physical vulnerabilities to cause fires, explosions or the hazardous release of toxic chemicals, threatening surrounding communities. Energy facilities, including high-voltage transmission substations, are vulnerable to deliberate disruptions that could cause cascading power outages and significant property damage. Similarly, the emergency services sector faces immense challenges from drones infiltrating state prisons to deliver dangerous contraband such as drugs, cellphones and weapons, or to conduct surveillance to aid escape attempts.

To apply for a standard UAFR, an applicant must be the operator or proprietor of a fixed site facility, defined as a permanent structure, building or asset with defined geographic boundaries. Furthermore, the facility must meet the definition of critical infrastructure as outlined in National Security Memorandum 22, which identifies 16 key sectors. The FAA, in coordination with Sector Risk Management Agencies, has developed specific eligibility thresholds to ensure only high-risk facilities apply. For example, eligible facilities in the chemical sector must manufacture, store or transport hazardous-release chemicals at or above minimum concentration percentages. In the commercial facilities sector, outdoor venues such as amusement parks must boast an annual attendance of at least 2.5m, have ticketing procedures and remain open to the public for at least 120 days a year.

The proposed thresholds are stringent across all sectors. The communications sector limits eligibility to vital broadcast network facilities, cellular towers, satellite uplinks and data centres with a peak traffic throughput of at least one terabit per second. In the dams sector, a facility must be a high-hazard hydroelectric dam producing 1,850,000 megawatt hours or greater, or a dam supplying drinking water to a population exceeding 500,000. The emergency services sector addresses the acute risk of contraband delivery by restricting eligibility to state prisons or correctional facilities housing 500 or more inmates. Within the energy sector, power-generation facilities must have a capacity of 500 megawatts or greater, and oil refineries must have the capacity to process 100,000 barrels a day. The healthcare and public health sector limits eligibility to Level I or paediatric Level I trauma centres equipped with helipads. The transportation systems sector permits UAFRs for rail secure areas, intermodal hubs, certain pipeline pump stations and highway bridges or tunnels serving 50,000 or more vehicles daily.

Merely meeting the sector thresholds does not guarantee a UAFR; applicants must actively demonstrate a safety or security need that justifies the restriction. The application process mandates the submission of comprehensive documentation, including an analysis of existing unmanned aircraft traffic patterns in close proximity to the facility over the previous 24 months. The applicant must detail the facility’s specific vulnerabilities to UAS operations and articulate the potential consequences if these vulnerabilities were exploited. Crucially, the FAA considers the UAFR to be a supplemental security measure, not a first line of defence. Consequently, the facility must maintain protective security measures, including restricted access, designated security personnel and active security monitoring. This monitoring must include the capability to passively receive and log broadcast remote identification messages from unmanned aircraft operating nearby.

The lateral boundaries of the requested UAFR must be narrowly tailored to the specific security concern. The boundary may consist of one contiguous area or multiple non-contiguous areas, but it cannot exceed the applicant’s property line or overlap with existing permanent airspace restrictions. The FAA aims to draw the smallest practicable polygon to preserve low-risk flight corridors between adjacent facilities, ensuring the national airspace system remains navigable. In addition to demonstrating security needs, the applicant must describe the externalities generated by the requested airspace restriction. This includes outlining the potential disruptions to known airspace users, such as commercial drone delivery routes or medical transport flights, and detailing efforts taken to minimise these negative impacts. The FAA is also required to comply with the National Environmental Policy Act of 1969. Applicants must therefore submit site-specific data identifying proximate sensitive land uses, such as historic resources, properties protected under the Department of Transportation Act, habitats of endangered species and seasonal nesting sites.

Upon receiving an application, the FAA evaluates the totality of the circumstances to determine whether the safety or security need justifies restricting the public’s right of transit. If the FAA concludes the application has merit, it issues a conditional approval. To ensure transparency, the FAA then publishes the proposed UAFR in the Federal Register, initiating a public comment period of at least 30 days. After assessing the feedback, the FAA makes a final determination; approved restrictions are published as a final rule in the Federal Register and incorporated into FAA Order JO 7400.12. If denied, applicants have 30 days to correct deficiencies or petition for reconsideration, provided they can demonstrate a material error of fact or law. A UAFR is granted for a maximum term of five years. To maintain the restriction, the operator must apply for a renewal no later than 120 days before expiration, ensuring the airspace restriction remains appropriate as UAS technologies and traffic management systems evolve.

To preserve the efficiency of the national airspace system and support the economic growth of the drone sector, in accordance with the ‘Unleashing American Drone Dominance’ directive, standard UAFRs allow specific categories of vetted operators to transit the restricted airspace. Permitted operations include those conducted under part 91 (such as public aircraft operations by law enforcement or emergency responders) and part 107 (commercial operations like aerial surveying). Furthermore, the rule anticipates the integration of proposed part 108 for beyond visual line of sight operations, part 135 for commercial package delivery and part 137 for agricultural spraying. These operators undergo stringent safety oversight and, where applicable, security threat assessments by the Transportation Security Administration. To lawfully enter a standard UAFR, an allowed operator must broadcast remote identification, transit the airspace in the shortest amount of time practicable and provide advance notice to the fixed site facility’s site manager.

The implementation of UAFRs will significantly aid local law enforcement. Currently, officers responding to reports of drone activity struggle to distinguish between compliant operators and potential threats. By establishing clear legal boundaries, the UAFR acts as a virtual no-trespassing sign, helping authorities focus their resources on genuinely suspicious or unlawful flights. Furthermore, the FAA’s exclusive authority to regulate aviation safety ensures that state and local attempts to regulate airspace are pre-empted, reducing regulatory confusion.

Unauthorised flights within a UAFR expose the operator to significant legal repercussions. The FAA can pursue civil enforcement actions, which may include civil penalties or the revocation of pilot certificates. Furthermore, if a UAFR is explicitly issued for national security or homeland security purposes under 49 U.S.C. 40103(b)(3), knowing or willful violations can trigger criminal penalties under 49 U.S.C. 46307. Implementing the UAFR framework carries a financial footprint; the FAA estimates that if over 9,000 eligible fixed site facilities obtain restrictions, the annualised compliance and government review costs will range between $21m and $31m. However, these costs are balanced against the substantial benefits of mitigating the risk of explosions, toxic releases, property damage and the loss of life that could result from unchecked drone activity near the nation’s most critical infrastructure.

Subscribe to get the latest posts sent to your email.