Domestic Counter-UAS: Authority, Critical Infrastructure, and the 2026 Rule Changes

The technical problem of detecting and defeating small drones is difficult. The legal problem of doing it over American soil has been harder. For most of the past decade, the capability to protect a stadium, a power plant, or an airport from drone incursion existed while the authority to use it did not — outside a narrow set of federal agencies and designated facilities.

That gap has now begun to close. The SAFER SKIES Act, enacted in December 2025 as part of the FY2026 National Defense Authorization Act, expanded counter-UAS authority to properly trained state, local, tribal, and territorial law enforcement operating under federal safeguards. The implementing interim final rule from the Department of Justice and Department of Homeland Security published on 6 July 2026, effective 1 July 2026, sets out the conditions.

Separately, on 6 May 2026 the FAA published a notice of proposed rulemaking to implement Section 2209 of the FAA Extension, Safety, and Security Act of 2016, establishing a proposed 14 C.F.R. Part 74 under which operators of fixed-site critical infrastructure facilities could petition the agency to restrict drone operations nearby.

For anyone selling, buying, or operating counter-drone capability in the United States, this is the most consequential regulatory shift in the field's history. This analysis explains what changed, what did not, and what it means commercially.

Why domestic counter-UAS was legally blocked

The constraint was never a single prohibition. It was the accumulated effect of several statutes written long before small drones existed.

Aircraft sabotage and destruction statutes. Federal law criminalizes damaging or destroying an aircraft. A small uncrewed aircraft meets the statutory definition of an aircraft. Shooting one down, absent specific statutory authority, exposes the actor to federal criminal liability regardless of the drone's behavior.

Wiretap and electronic surveillance law. Detecting a drone by intercepting its control or video link involves intercepting an electronic communication. Absent authority, that is a federal offense.

Communications law. Jamming a radio signal violates federal communications statutes. There is no general exception for defensive purposes, and the prohibition applies to federal, state, and private actors differently but restrictively in all cases.

Computer fraud statutes. Protocol takeover — commanding a drone to land — involves accessing a computer system without authorization.

The practical result was that a critical infrastructure operator observing a drone over their facility could look at it, and little else. Detection through passive RF sensing sat in a legal grey area. Mitigation was clearly unavailable.

Federal authority existed in a limited form for the Departments of Defense, Energy, Justice, and Homeland Security to protect specified covered facilities and assets. It did not extend to the overwhelming majority of critical infrastructure, which is privately owned and locally policed.

What the SAFER SKIES Act changed

The Act's central move is extending detection, tracking, and — in limited circumstances — disabling or seizing authority to state, local, tribal, and territorial agencies that meet federal training and compliance requirements.

Key features of the framework:

Eligibility is conditional, not automatic. Agencies must be properly trained and must operate under federal safeguards. The interim final rule establishes the specific requirements, which include training standards, coordination protocols, and reporting obligations.

Mitigation is narrower than detection. Detecting and tracking is authorized more broadly than disabling or seizing. Mitigation applies where a drone poses a credible threat to people, facilities, assets, major events, critical infrastructure, or correctional facilities.

Reporting and compliance obligations are substantial. The framework creates strict reporting requirements. Agencies exercising these authorities generate a documentary record subject to oversight.

Correctional facilities are explicitly covered. Contraband delivery by drone into prisons has been a significant and growing problem, and it received specific attention.

The FY2026 NDAA contained related provisions beyond the SAFER SKIES title. Section 912 establishes a task force to unify the Department of Defense's approach to counter-UAS. Section 3111 extends authority to the Department of Energy for nuclear security purposes. Title LXXXVI expands DHS and DOJ domestic tools while imposing the compliance and reporting structure.

The FAA airspace restriction pathway

The counter-UAS authority question is separate from the airspace question, and both matter.

Section 2209 of the 2016 FAA Extension Act directed the agency to establish a process for critical infrastructure operators to petition for drone flight restrictions over their facilities. Implementation took a decade. The May 2026 NPRM proposing 14 C.F.R. Part 74 finally sets out that process.

Under the proposal, operators and proprietors of fixed-site — permanent, non-mobile — critical infrastructure facilities could request that the FAA restrict uncrewed aircraft operations near those facilities.

Why this matters practically: a restriction establishes that a drone in the protected volume is operating unlawfully. That changes the legal character of the incursion, supports enforcement, and provides a clearer basis for response. Without a restriction, a drone over a facility may be doing nothing illegal at all, which complicates every subsequent decision.

The limitation to fixed sites is significant. Mobile assets, convoys, and temporary events fall outside the proposed framework and rely on other mechanisms — temporary flight restrictions for major events, and the separate federal authorities for designated facilities.

The operational picture driving urgency

The regulatory movement responds to a threat picture that has escalated visibly.

Drone incursions over military installations, airports, and critical infrastructure have become routine rather than exceptional. Major public events have generated substantial enforcement activity — more than 300 drone seizures were reported at FIFA World Cup match venues from 11 June 2026 onward, which indicates both the volume of incursions and the scale of response now being mounted.

The drivers are varied and the distinction matters for response:

Careless and clueless operators. The large majority. Hobbyists unaware of restrictions, commercial operators taking shortcuts, and media seeking footage. Educational and enforcement responses suffice.

Criminal use. Contraband delivery into prisons, smuggling across borders, surveillance for burglary and theft. Growing steadily and the most common category of deliberate misuse.

Surveillance and reconnaissance. Persistent unexplained overflights of military and energy infrastructure, some of which are plausibly deliberate intelligence collection. Attribution is rarely established.

Attack. Not yet common domestically, but the demonstrated capability in overseas conflicts establishes that the technical barrier is low.

A defensible domestic posture has to distinguish among these in real time, because the appropriate response differs enormously and the legal standard for mitigation requires a credible threat.

What this means for the commercial market

Several consequences follow for firms operating in this space.

Detection is now a substantially larger addressable market. Broadened authority and clearer airspace restriction pathways make investment in detection defensible for infrastructure operators who previously had no lawful use for the data. Passive RF, radar, EO/IR, and acoustic detection all benefit.

Mitigation remains constrained and will stay that way. Kinetic defeat over populated areas creates debris hazards. Jamming disrupts communications, aviation navigation, and nearby commercial systems. Neither is generally acceptable in the domestic environment except in narrow circumstances. Vendors positioning kinetic or broad-spectrum jamming solutions for the domestic market are selling into a legal envelope far narrower than the deployed-force market.

Non-kinetic, non-jamming defeat mechanisms are the growth area. Protocol takeover with safe landing, capture systems, and directed interception without wide-area effects fit domestic constraints better than the alternatives.

Compliance capability is a differentiator. The reporting and training requirements attached to state and local authority create demand for systems that produce compliant audit records automatically. A system that generates the documentation an agency needs to demonstrate lawful use has real advantage over one that does not.

Integration with existing security operations matters more than raw capability. Infrastructure operators have security operations centers, camera systems, access control, and incident response procedures. Counter-drone capability that integrates into that environment is adoptable; capability that requires a separate console and separate staff is not.

The buyer is different from the defense buyer. Utility security directors, stadium operations managers, airport authorities, and county sheriffs procure differently than program executive offices. Sales cycles, price sensitivity, procurement vehicles, and technical sophistication all differ.

Practical guidance for infrastructure operators

For organizations responsible for protecting a facility:

Establish what you may lawfully do before buying anything. Authority depends on who you are, what the facility is, and what the drone is doing. A private operator, a local police department, and a federal agency have materially different powers over the same airspace.

Start with detection and characterization. Understanding your actual incursion pattern — how often, what times, what flight profiles, what appears deliberate — is the prerequisite to any sensible investment. Most operators substantially misestimate their baseline in both directions.

Pursue an airspace restriction if eligible. Under the proposed Part 74 process, a restriction converts ambiguous overflights into identifiable violations, which materially improves the enforcement and response position.

Build the law enforcement relationship in advance. In most cases the lawful mitigation authority sits with a police agency rather than with the facility. That coordination has to be established before an incident, not during one.

Document everything. Incursion records support restriction petitions, enforcement referrals, and eventual mitigation authority. They also demonstrate diligence.

Plan for consequence management, not just interdiction. A drone that gets through is a scenario to plan for. Physical hardening, sensitive area coverage, and response procedures address the residual risk that no detection system eliminates.

Outlook

The FAA Part 74 rulemaking will need to be finalized, and the comment process is likely to surface substantial disagreement between infrastructure operators seeking broad restrictions and the uncrewed aviation industry concerned about airspace fragmentation. The final rule may look meaningfully different from the proposal.

The state and local authority framework will be tested in practice, and early enforcement actions will shape how conservatively agencies interpret their powers. The reporting obligations create a record that will inform whether the authority expands or contracts in subsequent legislation.

Expect continued pressure to extend authority further — to private critical infrastructure operators directly, rather than requiring law enforcement involvement for every response. That expansion faces legitimate objections about private parties interfering with aircraft, and it is the next significant policy fight.

Expect the technical problem to get harder even as the legal problem eases. Fiber-optic and autonomous drones defeat RF detection and jamming, which are the mechanisms most compatible with domestic constraints. The domestic counter-UAS toolkit may be losing effectiveness against the most capable threats precisely as it becomes legally usable.

For the commercial market, the direction is clear enough: a substantially larger set of lawful buyers, constrained mitigation options, and a premium on detection quality, integration, and compliance documentation.

Frequently asked questions

Can a private company shoot down a drone over its property? No. Federal statutes criminalizing damage to aircraft apply to small uncrewed aircraft, and private parties have no general authority to disable them. Mitigation authority rests with specified federal agencies and, under the SAFER SKIES Act framework, with qualifying state and local law enforcement operating under federal safeguards.

What is the SAFER SKIES Act? Legislation enacted in December 2025 as part of the FY2026 NDAA that extends counter-UAS detection, tracking, and limited mitigation authority to trained state, local, tribal, and territorial agencies. The implementing interim final rule from DOJ and DHS was published on 6 July 2026.

What is FAA Section 2209 and Part 74? Section 2209 of the 2016 FAA Extension Act directed the FAA to create a process for critical infrastructure operators to request drone flight restrictions. The proposed 14 C.F.R. Part 74, published as an NPRM on 6 May 2026, implements that process for fixed-site facilities.

Is drone detection legal for private operators? It depends on method. Passive detection using radar or optical sensors raises fewer legal issues than RF detection, which may implicate electronic communications interception statutes. Legal review of the specific technology and configuration is essential.

Why can't jamming be used domestically? Federal communications law prohibits intentional interference with radio communications, with no general defensive exception. Jamming also disrupts aviation navigation, emergency communications, and commercial systems in the affected area, which makes it operationally unacceptable in most domestic settings regardless of authority.