Who Owns the Sky

Welcome to your weekly briefing.

Most of us have stood on a site and watched something small and buzzing hold position overhead. First mild irritation. Then the slower realization that we do not have a plan for it. Maybe you called it in. Maybe you watched it drift off and got on with the day.

Afterwards, you probably asked what you’d do if it came back. Most of us could not say much beyond calling the police. There is now a federal rule that answers part of that, and it lets private security do far less than the vendors have promised. This week On the Circuit, we look at who is allowed to bring a drone down.

A federal rule that took effect on July 1 settles who may legally bring a drone down in American airspace, and private security is not on the list. It appeared in the Federal Register on July 6 as 6 CFR Part 124, written jointly by the Department of Homeland Security and the Justice Department.

Contractors may not operate mitigation systems, and the rule excludes non-government entities altogether. You cannot buy the authority, and you cannot borrow it by working under a friendly police department. Jamming a control signal, seizing an aircraft electronically, or shooting one down is reserved for a certified government officer, and no commercial contract changes that.

Detection stays legal. Buying the kit is fine, running it is fine, and so is logging everything it sees. A record of time, bearing, altitude, and how long the aircraft held position gives a responding officer something to work with. A phone call describing a light in the sky does not.

The authority now reaches state, local, tribal, and territorial police for the first time. Detection needs an online FBI certification. Taking an aircraft down needs resident training at the FBI schoolhouse, a policy signed off by legal counsel, notification to air traffic control before and a report to Washington after, and the footage deleted inside 180 days. Most departments will not have that in place for months.

If you run a fixed site, the useful call is to the FAA rather than a vendor. Operators of qualifying critical infrastructure can petition the agency to restrict drone flights overhead. The FAA decides, and weighs the request against economic interest, so nothing is guaranteed.

Federal agencies seized more than 700 unauthorized drones across eleven US host cities during the World Cup. Comments on the rule close on September 4.

We have spent three years being sold detection-and-takedown packages, and most of us were quoted for something we were never going to be allowed to switch on. What the rule leaves us is unglamorous and hard to put on an invoice. Spot it early. Log it properly. Know which officer to call.

That last one is worth doing this month. A named contact at the local department, made before there is a drone over a client's roof, will do more for a principal than any system a vendor can sell us.

Two decades of expert insights you can trust.

🇩🇪 Germany. Berlin police shot and killed Abdul Ballout, 21, on Sunday after a van drove into crowds at Christopher Street Day, killing one and injuring 29. Fourth such attack in Germany since 2024.

🇮🇶 Iraq. Air defenses downed three drones near the US consulate in Erbil and the airport halted all flights. The mission remains on ordered departure. Erbil is the main gateway into Kurdistan.

🇱🇧 Lebanon. A July 17 alert sits on a Level 4 Do Not Travel advisory, with non-emergency US personnel under ordered departure since February, and advises planning alternative exit routes.

🇾🇪 Yemen. The Houthi blockade of Bab el-Mandeb remains in effect after the group struck two Saudi-flagged tankers on Wednesday.

EVENT SECURITY. The White House Correspondents' Dinner returned on July 24 at the Waldorf Astoria, three months after a gunman ended the April event. Every guest presented a unique QR code alongside government photo ID. Access ran through one entrance fitted with magnetometers, every other door sealed. The guest list was cut to 700, sized so the crowd fit the screening teams.

THIRD-PARTY RISK. Craneware, the Edinburgh billing-software maker used by thousands of US hospitals and pharmacies, told the London Stock Exchange that attackers took employee and customer records. Its 2021 purchase of Sentry brought access to 147 million patient records, so one breach at a single supplier reaches data held across hundreds of providers. It follows Change Healthcare at 192 million people.

CISA and six partner agencies revised an advisory naming Rockwell, Schneider Electric, and Siemens controllers as Iranian targets at US water and energy sites.

The agent JadePuffer now carries ransomware built to destroy AI systems, at a rebuild cost Sysdig puts between $75,000 and $500,000 per model.

Joshua Kerry, 28, was charged with murder and terrorism over the death of former MP Ann Widdecombe, our top story two weeks ago.

A seven-inch knife went through an AI weapons scanner and into a school. The system was built to catch exactly that. It missed, then started flagging water bottles instead.

That distance matters. What a monitoring system does in a sales demonstration is rarely what it does on your floor at three in the morning, and the gap runs through every autonomous surveillance product now sold to security teams. This week's premium briefing sets out what the technology reliably does today and what is still marketing. It covers the bias and false-positive figures behind wrongful detentions, the model-poisoning and vendor-breach exposure a team inherits the day it connects one, and where US, UK, and EU law draws the line. It ships with a scored toolkit for grading a product before deployment.

The question the piece keeps returning to is who owns the alert. When the model flags something at three in the morning, a named person has to decide what happens next. If the honest answer is that the system handles it, then nobody is watching.

Read it and download the toolkit →

Premium subscribers get the full briefing and the toolkit. Not premium yet? Upgrade for subscriber-only tactical analysis and every future briefing.

Q: A client wants to trim the residential detail to save cost. What do you lead with to keep it?

🟩🟩⬜⬜⬜⬜ A. The documented threat history on the principal (31%)
🟨⬜⬜⬜⬜⬜ B. A recent case that highlights the threat (23%)
🟩🟩🟩⬜⬜⬜ C. The liability and exposure they suffer, if it goes wrong (46%)
⬜⬜⬜⬜⬜⬜ D. Something else. Let us know (0%)

Your Comments:

NC: “C.C.T.V is vital too but that is just a tool in the defense of valuables and recording crimes for evidence in court. Persons on the ground is the first line of defense...”