The FAA finally released its long-awaited draft rule implementing Section 2209 of the 2016 FAA Extension, Safety, and Security Act, and public comments closed on August 5th. Two of the drone industry’s most experienced voices, Charlton Evans, founder and CEO of End State Solutions, and Calvin Rieb, senior director at Cargill, spent nearly an hour on the Dawn of Autonomy podcast explaining why a rule almost a decade in the making still misses the mark on the problem it claims to solve.
From Harrier Cockpits to Grain Silos: Two Paths Into Drone Policy
Evans brings more than 35 years of aviation experience to the conversation with a career that spans three decades of military and commercial aerospace. He graduated from the Naval Academy in 1994. From there, he went on to fly Harriers in the Marine Corps. He later deployed to Iraq as a joint tactical air controller, coordinating video feeds from multiple aircraft platforms alongside ground troops. That deployment led directly to a job at Insitu, where he ran a deployed operations section that grew from 60 people to more than 500. Working within Insitu’s small commercial division, Evans helped certify a ScanEagle (an aircraft now housed at the Smithsonian) under a restricted category to fly missions for ConocoPhillips and BNSF, including wildfire response. When that commercial division failed to gain traction internally, he founded End State Solutions (ESS).
At ESS, Evans now guides emerging aerospace companies through FAA certification, airworthiness approval and exemption pathways. His client work spans small unmanned platforms through advanced air mobility, high-altitude platform systems, and conventional aircraft. “We take emerging tech companies, for the most part, that are at the point where they’ve got a mature product or a maturing product, and they’re ready to put it in service, create revenue with it,” Evans said, describing how his team produces the test plans, safety cases and documentation the FAA requires to approve, waive or exempt new aircraft operations.
Rieb’s path into the industry started earlier and ran through a different branch of the military. He caught the aviation bug working at a fixed-base operator in high school and earned his pilot’s license before enlisting. He served as a UH-60 helicopter mechanic in the Army, eventually working his way up to warrant officer and flying C-12 aircraft on global deployments. Those deployments gave him his first real exposure to unmanned systems, watching drones return to base after losing their control link.
After leaving the military, Rieb moved into consulting for ARGUS International and its Prism subsidiary, where he helped more than 150 helicopter flight departments build safety management systems and pass industry audits. When that firm acquired a small unmanned aircraft education company, Rieb found himself pulled deeper into UAS work, eventually helping package delivery companies navigate the FAA’s Part 135 certification process and assisting large enterprise clients, including Cargill, manage the risk and compliance challenges of operating drones at global scale. That work led to his current role, where he has spent the past seven years building and running the drone program for Cargill, a 161-year-old, family-owned company with roughly 155,000 employees across 70 countries. “It’s been a journey,” Rieb said, “and the regulatory environment…continues to make it challenging to get things off the ground…”
Evans and Rieb met through the National Business Aviation Association’s Emerging Tech Committee. Their shared frustration with Section 2209 grew out of sitting on opposite sides of the same regulatory puzzle: one guiding emerging aerospace companies through FAA certification, the other running a drone program inside one of the largest privately held companies on earth.
What Section 2209 Actually Does
Section 2209 directs the FAA to create no-fly zones, essentially temporary flight restriction (TFR) equivalents, over critical infrastructure. The newly released draft rule touches all sixteen critical infrastructure sectors designated by the Department of Homeland Security, spanning everything from energy and water systems to food and agriculture.
That last category puts Cargill squarely inside the conversation. Cargill’s scale makes the stakes real. The company touches the global food supply chain in ways most consumers never see. It ranks as the second-largest cocoa trader worldwide, supplies the oil behind a large share of fast-food french fries and manages 70,000 hectares of palm plantation in Indonesia. Drones already support that footprint through asset inspections, surveying, and stockpile assessments, with active security deployments at sites in Brazil and Argentina.
Education, Enforcement, Infrastructure All Needed
Evans framed the core flaw in Section 2209 as a mismatch between the scale of the threat and the tools the rule actually provides. “We agree with the intent,” he said. “We agree with the concept that drones are tools that are used for good in many cases, and humans are also going to use them in noncompliant ways or for nefarious purposes.” Regulators should focus their energy as much on the behavior as the technology.
Rieb pointed to the World Cup as recent proof. Authorities confiscated more than a thousand unauthorized drones. The majority were flown by hobbyists who had no idea they were breaking any rules. “There’s a lack of education and awareness out there,” Rieb said.
Add to that the problem of a “hollow enforcement structure.” Rieb traced the enforcement gap back to years of light-touch oversight after Part 107 rules for commercial drones took effect. “I think we didn’t see a lot of enforcement from the FAA after 2017, when Part 107 was really taking off,” he said.
Besides the clueless and careless, then there’s the criminal. Weaponized drones represent a risk that has become easier to execute as evidenced by the war in Ukraine and the Middle East. Even with 2209, critical infrastructure asset owners still carry the weight of potentially addressing weaponized drones without the authority because 2209 does not provide it to them. In fact, a SUAFR designation does not come with detection equipment, trained personnel or mitigation authority. It simply draws a boundary on a map. Companies still have to buy the sensors and staff a monitoring desk themselves. Local law enforcement, who finally does have detect and warn, and with proper training, mitigation authority, may not have the equipment needed or be able to respond to the asset in the timeline needed to safeguard it.
The Disclosure Paradox
Perhaps the most ironic problem the two guests raised involves disclosure requirements baked into the rule itself. To gain protected status under Section 2209, a company has to formally identify and reveal the very site it wants to shield, which many organizations treat as a security layer in its own right. This effectively publishes what effectively becomes a map for anyone looking to cause harm. Rieb laid out the tradeoff. Declaring a site as a Special UAS Facility Restriction, known as a SUAFR, essentially provides a “targeting map,” he said.
Besides the location itself, the approval package requires asset owners to provide a litany of sensitive information, according to Evans. Examples include information from Remote Identification encroachment data and physical security measures the asset owner takes on the ground
“It’s been sold as this easy button,” Rieb said, but many organizations publicly supporting the rule may not fully grasp what the designation actually requires operationally or technically.
Who Runs the Desk
Another administrative concern that carries real financial weight: once a facility earns protected airspace status, who actually manages access requests from every legitimate operator that wants to fly there?
Evans predicted the FAA itself will face little friction approving these designations, since the agency bears none of the operational burden. The real cost lands on industry. “There’ll be a burden on the FAA, but compared to the burden on industry, I think it’s going to pale in comparison,” he said. He also believes the rule creates obligations nobody can fulfill. “The rules don’t reflect the technology capability, and it puts a huge burden on the infrastructure and operators to actually own that whole process, which they’re not capable of doing.”
He described a scenario where a protected agricultural site collides with a legitimate commercial drone operator trying to do business nearby, and the resulting dispute becomes a legal problem rather than an airspace problem. “It’s just a huge Pandora’s box of complexity when you look at how the airspace might be impacted at the low altitudes from commercial drone operation,” he said, pointing to delivery companies including Google Wing, Amazon and DoorDash as operators for whom the rule fails accounts.
Rieb connected that liability exposure directly to his own experience managing Cargill’s drone incursion policy, which currently instructs employees to go inside and contact local authorities when an unauthorized drone appears near a site. He does not see Section 2209 changing that reality in any meaningful way. “Even when you look at 2209, how is that going to change? It doesn’t really change,” he said.
He also raised the uncomfortable question of what happens after a drone gets shot down? For example, a defeated aircraft in Russia fell and injured bystanders who were never the intended target. “Liability of even mitigating these drones, in itself, is also something we’re assessing and concerned about,” he said.
A Training and Funding Bottleneck
Even where the legal authority to mitigate drones exists, the people equipped to use it remain scarce. State and local law enforcement gained expanded counter-UAS authority under recent legislation, but training pipelines remain slow. The shortfall runs deeper than that. Local departments frequently lack both the funding for the equipment to act, regardless of what authority the rule grants them on paper. “Somebody’s gotta pay for it,” Rieb said. Cost remains a barrier that stands between good intentions and real capability.
Asked to name their top concerns, Evans cited implementation, capability to enforce the rule, and the financial burden placed on industry without corresponding tools or funding. Rieb added a technical wrinkle that undercuts the rule’s altitude ceiling. Part 107 already permits operators to fly up to 400 feet above a structure. 2209’s ceiling is 400 feet AGL. That means a drone can legally hover above a protected facility and drop something from above, a tactic he noted has already appeared on the battlefield in Ukraine and in U.S. prisons. “It’s a flawed policy,” he said. “There’s a lack of education, awareness.”
Both guests plan to keep pushing for revisions through advocacy organizations, betting that a second round of rulemaking will offer a better chance to close the gaps they spent the episode describing. Their shared message to regulators and infrastructure owners is that a boundary on a map doesn’t solve the drone education gap…and means nothing without the people, training and technology to defend it.