The recent incident at Gatwick airport highlights just how difficult drones are to counter, both legally and practically. With over 3 million passengers per month transiting the airport, even a small disruption can cause significant and long-lasting effects. And there is no need to bring down an aircraft, the massive disruption can be caused with a £700 toy.
The legal situation is that the Civil Aviation Authority governs UK airspace, and they have recently adjusted the air navigation order to say that drones cannot be flown within 1km of an airport, irrespective of where they take off from. Furthermore, there are strict rules that drones can only be flown under 400ft (the lowest flying planes fly at about 500 feet). Primarily this legislation exists for safety reasons; drones can damage aircraft in the same way as bird strikes (US Airways flight 1549 which landed on the Hudson River in New York was brought down by Canada Geese hitting both engines).
However, laws are really only of use if the criminal is caught, and drone pilots can be very difficult to find. Even commercial drones (with longer loiter times due to better quality batteries) are often too small to appear on radar systems. And not every business is an airport, therefore businesses which are vulnerable to drone activity will often not even have this flimsy legal protection.
In practical terms, there are numerous companies developing technologies to jam drone radio signals, and GPS geofencing. DroneShield has developed a device that can both jam the signal and bring down the drone and claims that this technology brought down a drone at the 2018 Commonwealth Games.
So what?
Drone activity, either for gathering information, causing disruption, or committing outright criminal acts (in 2018 Venezuelan president Nicolas Maduro survived an assassination attempt involving a drone carrying a small amount of explosives) is now a new form of threat to which many businesses will be vulnerable, especially those which operate outdoors such as the oil and gas industry. Given the scale of the potential disruption and risks to company reputation, companies and their business continuity/resilience experts would be well-advised to add the potential impact of drones to their horizon scanning and their security analysis with a focus on their aerial vulnerabilities to drone-enabled activity, and how to counter or avoid them.
Further information can be found at https://www.wired.co.uk/article/gatwick-drones.
Update: https://www.theguardian.com/business/2019/jan/22/easyjet-gatwick-drone-cost-brexit-flights