Drones – A New Business Continuity Threat?

Charlie Maclean-Bristol discusses the use of drones, the disruption they can cause to businesses, and why they are being used more frequently.

I have been closely following the Ukraine war, especially as I am ex-military and have been fascinated by the rapidly changing use of drones. The use of drones started with Ukraine employing the Bayraktar TB2 at the beginning of the war, which resembled light aircraft using missiles similar to those used in manned aircraft to attack vehicles. More recently, there has been the use of small drones to drop bombs on individual vehicles or groups of soldiers in the open and in trenches. Both sides now use kamikaze drones, with images showing them flying into windows or dugouts to attack individuals. This week, a drone attacked a U.S. military base in Jordan, resulting in three U.S. service members being killed and dozens injured. It is suspected to be carried out by Iranian-backed militias. This got me thinking about how the use of drones could impact business continuity.

When we consider protecting critical sensitive sites or infrastructure, we usually consider surface threats. Thus, we build fences, gates, and barriers to prevent attackers from easily gaining access and damaging site infrastructure. CCTV may alert you to an attack, but the physical barrier slows or stops the attacker until the security response can reach the breach location. There has always been a threat from the air, but it is challenging to hire a helicopter or a plane and then equip them to attack a site. In the 9/11 attacks, planes were used as bombs, but there was an immense amount of preparation work by the terrorists, including learning to fly airliners before they could implement their attack.

The use of kamikaze or drone-dropped munitions changes the security dynamic. As seen in the 2019 Saudi Oil infrastructure attacks, drones can be launched from hundreds of miles away and cause serious damage to their targets. The Saudi attack impacted approximately 5.7 million barrels of oil per day of production, representing roughly 5% of global oil output, causing a temporary dip in global oil supply and a subsequent spike in oil prices.

Small drones, as used by Ukrainian forces, can be launched kilometers from their target and, with improvised explosives or incendiaries, could cause damage to infrastructure or shut down production. While critical infrastructure can generally afford protection from anti-aircraft missiles or jamming equipment, this would be difficult to justify for smaller, non-critical infrastructure sites.

In addition to using drones to attack infrastructure, they can be used to disrupt, especially at airports. In December 2018, hundreds of flights were canceled at Gatwick Airport following reports of drone sightings close to the runway. The sightings caused massive disruption, and the culprit was never apprehended. It would be very easy for protesters to disrupt airport operations, which could be done by one person rather than relying on organizing many people to protest. I suspect that there are jammers around airports, but in Ukraine, there was a cat-and-mouse game between drone operators and those trying to jam them. The technology from Ukraine may leak, and small drones may have technology built into them to avoid jammers.

Before drones, the site of an incident might be within a security fence or screened off to prevent the press from taking pictures. Media organizations or amateurs will use drones to get shots of the site of an incident. Covering up incidents or the magnitude of an incident was a lot easier before the availability of drones.

There has been at least one attempt at a non-military use of drones as an assassination tool. In August 2018, two GPS–guided drones laden with explosives were used in a failed attempt to assassinate Venezuelan president Maduro. Similarly, drones could be used to attack an individual, vehicle, or aircraft in kamikaze mode. The attacker can be kilometers away, and the sanitized and searched cordon or route is no longer relevant. The security surrounding a VIP could be compromised by a remote drone attack, with those in the security detail either surrounding the VIP, on the route, or overwatching, having no time to react before the kamikaze drone hits their target. Will we see anti-drone canopies on VIP cars in the future, as we have seen on Israeli and Russian armored vehicles?

I am not sure there are ready answers on how to defeat a drone attack, and to date, there have been limited non-military attacks, but I think this should be a threat you keep an eye on and include in your organization’s horizon-scanning.