Drones over Norway: A Security and Regulatory Analysis

Posted by & filed under Security

Over the last five weeks, numerous incidents involving drones have made headlines in Norway. These incidents include multiple drone sightings outside oil platforms and energy installations, drone incursions in the vicinity of airports leading to the temporary closure of some of them, and Russian citizens being arrested at Norwegian border crossing sites and airports in possession of drones and drone-collected data on their way back to Russia.

Photo: Richard Unten / Wikimedia Commons

There are obviously too many occurrences for this to be chalked to be a mere coincidence, but there is something deeper and problematic taking place here: for years, Norway has been ill-prepared to face the drone threat, and the current scenario of hybrid war in Ukraine and beyond has only made those vulnerabilities bigger, more dangerous, and more visible.

Drone threats in Norway

The proliferation of cheap, commercial drones was recognized as a security threat for Norwegian civilian and military facilities by the Norwegian National Security Authority (NSM) in a 2017 risk assessment report. Since then, public institutions and private companies have taken steps to implement regulatory, preventive, and protective measures against the threat posed by drones in Norwegian civilian contexts.

But many initiatives have stalled amidst other priorities. For example, in 2017, the Bomb Squad, part of the Oslo Police Department, was given responsibility for the police’s counter-drone efforts and technical expertise, and is the national contact point for other partner entities within the counter-drone technology (or C-UAS, as these systems are generally known) field. The Bomb Squad delivered a report mapping the risk landscape and recommended counter-drone measures to the National Police Directorate (POD) in December 2018, but no relevant or significant follow up took place; today, police authorities remain widely ill-equipped to deal with non-cooperative drones, as Aftenposten highlighted in their cover on October 20th this year.

It is important to mention that this does not apply exclusively to Norway, and drone vulnerability is indeed a general characteristic of most metropolitan areas. In order to address this, the European Commission’s DG Home, responsible for internal security, has prepared a handbook to increase preparedness of European metropolitan areas in face of drone threats. PRIO has contributed to that handbook and it is hoped that it can be released soon.

As drones start to populate civilian airspaces all over the world, new vulnerabilities have emerged in our societies. As of today, the combination of the nature of the threat with the operational and technological shortcomings make the vulnerability of soft targets a clear reality, as demonstrated in Norway over the last weeks.

The issue of drones in the vicinity of airports, in particular, has been a ticking bomb. In a normal month in Norway, there are often dozens of illegal drone flights operating in restricted airport areas. Like other airport managers around the world, Avinor, the company that manages Norwegian airports, has the competence to use counter-drone technology to detect drones, but cannot do anything about engaging them and bringing them down besides contacting the police. Additionally, it is difficult to distinguish a malicious drone operator from a careless one that might not even know the rules about flight restrictions.

In off-shore oil platforms, the situation is considerably more complicated. On Norwegian soil, the general responsibility for counter-drone efforts and risk evaluation lies with the police, the Armed Forces, and the Norwegian National Security Authority (NSM), but offshore installations are subject to a different legal framework, which further complicates the issue.

For offshore installations and petroleum facilities, the responsibility for risk management is with the operators. As established by the Framework regulation for health, environment, and security in petroleum activities (Forskrift om helse, miljø og sikkerhet i petroleumsvirksomheten og på enkelte landanlegg – rammeforskriften) §57–59, the operators have a duty to establish and implement security zones around their facilities. The security zones should be of 500 metres, both horizontally and vertically. Within their responsibilities lies the surveillance of these zones, and taking action – which may include physical measures – if the infringement of the security zone leads to serious danger to the security of the operation. But these facilities would not, in theory, have the legal authority to intercept drones, since this authority is currently only held by the police.

This example illustrates how legal frameworks lag behind technological developments, creating a paradox in which the facility operators are on the one hand responsible for managing security risks, while on the other they are forbidden from applying the necessary measures by a contradictory legal framework.

What to do about a non-cooperative drone?

There are many different types of counter-drone technology, both to detect, track and identify drones (radars, radio frequency, electro-optical, infrared, acoustic, and a combination of some of the above),  and to engage with them (radio frequency jamming, spoofing, laser, microwave power, nets, projectiles, collision drones, and a combination of some of the above). They are explained in detail in this 2019 report from the Centre for the Study of the Drone and in PRIO’s 2020 report on counter drone technologies and drone vulnerabilities in Norway. But their efficiency varies substantially from one operational scenario to another, as they have broader societal and operational implications, and generally fall under different regulatory frameworks. Whereas most detection systems are properly regulated and can be deployed, the systems that engage with the drones are regulated differently.

Indeed, the application of many counter-drone measures is illegal under current Norwegian law. In Norway, these legal restrictions severely limit who, when, and under what conditions C-UAS technology may be applied. The Civil Aviation Authority of Norway (CAA) is the actor generally responsible for establishing restricted zones where the usage of drones is forbidden or limited.

The police may also institute interim restriction zones under the terms of The Police Act (Lov om politiet – Politiloven) §7, which outlines exemptions that may be granted as necessary to meet security, tactical, or investigative needs. Intercepting drones is defined as a use of force, and may only be carried out by the police. Jamming is the default strategy currently being pursued by the relevant agencies; however, the police does not have the legal basis to interfere with or stop electronic communication.

Further, the use of sensor detection systems may grant access to personal data, thereby infringing privacy laws. In practice, this means that the police may only use counter-drone measures such as jamming when justified within the principle of necessity (nødrett) – that is, to respond to a threat to life or national security. Operating within this legal realm puts severe restrictions on the conditions under which counter-drone technology may be utilized for training purposes or active missions.

Additionally, there are severe operational difficulties of countering non-cooperative drones. In metropolitan areas, for example, counter-drone technologies, operating in a regulatory environment that is not fully updated, are unable to provide a clear and immediate distinction between mal-intentioned and merely careless drone users. Considering this, in the case of a drone sighting in, for example, an urban area, where the intention of the drone operator is hard to determine, the vulnerability of the soft target comes from the mere presence of the drone. In some cases observed in the past in other parts of the world, such as with energy-producing facilities, the sighting of a drone has meant everything from industrial espionage to climate activism and terrorism. Whilst the high number of sightings in Norway in a short span of time indicates that they are not a coincidence, it is impossible to clearly point to a particular operator behind the drone and to an objective behind that flight.

The way forward – what to expect in the weeks and months ahead?

Drones are a fundamental part of today’s geopolitical context. They are playing an important role in how both Russia and Ukraine are conducting their operations in the war. But they are also part of a broader hybrid war logic by which they are employed abroad not only to conduct surveillance and data gathering activities, but also to cause psychological stress and generate uncertainty in the population. It is worth recalling that the current drone sightings in Norway are not the first such incidents in 2022. In January and February 2022, weeks and days before the beginning of the war in Ukraine, multiple drone sightings occurred in Sweden, both in energy producing facilities and in sites of political and symbolic power in Stockholm, such as the Royal Palace.

In the weeks and months ahead it is expected that similar drone activity might occur in other locations (other countries in Northern and Eastern Europe, for example), and that aquatic / submarine drones will be used as well. As for Norway, the intense media attention that the issue has attracted will certainly mobilize politicians and other bureaucrat decision-makers to adopt measures that have long been kept in the drawer.

Several factors contribute to the current state of vulnerability: general affordability and flexibility of drone technology, regulatory hurdles surrounding new technology, and a lack of efficiency of counter-drone systems. But there is also another important factor that does not receive enough attention; this is the tension between the ones that want a quick integration of drones in the civil airspace, and the ones that are mostly focused on security and societal concerns. Among the former are not only drone users and manufacturers, but also decision-makers that see in drones the solution to all sorts of problems, from air mobility to green energy transition. On the latter group are security officers, specialized police and military units, as well as civil society organisations that for years have been pointing out to the risks of a scenario like the one being observed in Norway today. It is crucial that both sides of this ongoing debate are called to participate in regulatory and legislative processes, so that a fuller spectrum of the drone potential can be considered when moving forward with their integration in society.

To know more:

PRIO research on drones and societal resilience

 

Selected publications

Share this: