Flying Cameras: Gaps in Drone Regulation and How Courts Can Fill Them . . . for Now

• Jurisdiction: United States,Federal
• Publication year: 2022
• Citation: Vol. 2 No. 4

Kathryn M. Rattigan and Blair Robinson ^*

Abstract: The widespread use of commercial and personal use of unmanned aerial vehicles, also known as UAVs or drones, is in early days, finding applications in deliveries to consumers and people in need of medical supplies, as well as farmers and photographers. As with any new disruptive technology comes new regulations and questions about the applicability and adequacy of existing laws. In this article, written by an attorney whose practice focuses on this area of law and a member of her team, the authors discuss a range of topics, including cybersecurity, privacy, and strict liability, as well as regulations promulgated by the Federal Aviation Administration and the National Transportation Safety Board, recent court decisions, and other legal aspects of this exciting new industry.

Since bursting onto the scene over ten years ago, unmanned aerial vehicles (UAVs) ¹ have quickly revolutionized many industries. For example, international aid groups have used medical UAVs to deliver life-saving medications and vaccines to remote areas. ² Farmers have adopted agricultural UAVs to revolutionize how they tend their fields. ³ Film and television producers have embraced UAVs for their ability to capture once prohibitively expensive or outright impossible camera shots, and hobbyists have embraced the technology for recreation. However, as UAVs have become increasingly commonplace, lawmakers and policymakers have struggled with effectively regulating this emerging domain. No federal law, state law, or industry best practice adequately addresses the unique privacy and cybersecurity risks posed by UAV operations. Until federal regulation catches up with the technology, the courts may

[Page 310]

mitigate the issue by developing a system of strict liability for UAV operators and manufacturers.

Although UAVs may seem like a simple derivation from traditional aircraft, these new products present unique privacy concerns. Courts and policymakers have sought to address the obvious and highly publicized issues associated with UAV flight, such as irresponsible pilots harassing pedestrians ⁴ and disrupting airports ⁵ while neglecting the novel threat that UAVs pose to personal privacy. Unlike crewed aircraft, UAVs often use remote cameras and other sensory inputs to guide their operators. In this way, UAVs are more akin to flying smartphones than traditional crewed aircraft. Additionally, UAVs have a unique ability to collect visual and other sensory data at a great distance and without alerting the data subject. As a result, the individual(s) whose privacy is infringed upon will likely never know (or identify) the UAV operator, regardless of whether they see the offending device. In addition, the growing ubiquity of UAVs, such as consumer goods distributors' anticipated delivery drones may further obfuscate voyeur's identities—was that UAV that just flew past the house looking through the window or just delivering the neighbor's package?

UAVs present novel cybersecurity risks as well. UAV systems rely on real-time and simultaneous data exchanges between the operator, GPS positioning, cloud-based processing and telemetry, and the UAV itself. ⁶ Each facet in such a complex system presents a new opportunity for attackers. ⁷ Besides attacks targeting data in transit between the UAV and its control systems, UAVs are also vulnerable in a more physical sense. For example, researchers at the University of Texas at Austin successfully hijacked a UAV using commercially available equipment. ⁸ The researchers used a local GPS transmitter to send the UAV false coordinates, causing it to fly off its preprogrammed path. ⁹ The criminal and terror applications are evident—terror groups could use this technique to hijack UAVs and cause them to fly into buildings, thieves could intercept consumer UAV deliveries, and militant groups could capture and ransom critical medical deliveries. Therefore, UAV operators (and manufacturers) must adequately secure their devices before they can see widespread use.

[Page 311]

Perhaps the most logical place to look for UAV regulation is the Federal Aviation Administration (FAA). The FAA first began regulating UAVs in 2014, when the National Transportation Safety Board (NTSB) found in Huerta v. Parker that UAVs qualify as aircraft under FAA purview. ¹⁰ However, the FAA's existing regulations approach UAVs as a variation of traditional crewed aircraft rather than as a "flying smartphone." The current FAA rules require UAV operators to register their machines and regulate activities like night flights and flights over pedestrians. ¹¹ Still, the FAA has no existing regulations or guidelines addressing UAV privacy or cyber security concerns. The FAA does not believe that it has the authority to regulate the processes associated with UAV operations that present privacy and cybersecurity issues. ¹² Therefore, the FAA is currently unable to provide the sorely needed regulations. In addition, while other federal statutes address specific UAV data flows, no complete regulatory scheme exists. ¹³

State-level UAV regulations are similarly lacking. While some states regulate UAVs use by law enforcement ¹⁴ and many smaller localities have piecemeal ordinances regulating UAV...