Washington seems to be declaring victory over the policy fight in counter-UAS. I have covered this space long enough to recognize an inaccurate assessment of reality when I hear one. The policy is not finished.
The laws and regulations relating to counter-UAS have made genuine strides over the past two years. New legislation aimed at protecting critical infrastructure giving state, local, tribal and territorial (SLTT) law enforcement agencies detection and mitigation authority for the first time, became law through the latest defense authorization bill. (See prior AG coverage of SAFER SKIES). A separate interim rule from federal law enforcement agencies took effect this summer, which lays out training and certification requirements tied to that new authority, and agencies have begun working through that certification process. (See prior AG coverage of the SAFER SKIES IFR). A proposed rule from the FAA covering enforceable no-fly zones over critical infrastructure sites remains under review, not yet finalized, after drawing more than a thousand public comments. (See prior AG coverage of Section 2209) A new executive order is reportedly under consideration to build on those gains, though that remains an anticipated step rather than a confirmed one. Given all that motion, it makes sense that people inside the Beltway feel like the hard part is behind them. But it is not.
Why DC Believes The Authorities Fight Is Over
The confidence comes from real progress, and it deserves credit. The SAFER SKIES Act stands out as landmark legislation, since it marked the first time Congress gave SLTT agencies real legal footing to detect and mitigate drone threats rather than leaving that authority concentrated at the federal level. People close to this effort describe it as a genuine game changer for protecting critical infrastructure. The law’s passage is exactly the kind of milestone that fuels the sense in Washington that the “authorities” fight has been won.
Expanded authorities tied to the latest defense authorization bill also now let federal entities share detection and track data with counterparts across agency lines. Updated guidance issued earlier this year removed the old fence line limitation that used to strand a detection at one boundary while the response sat helplessly on the other side of it.
Federal agencies are also working to reduce overclassification of incursion data, an effort aimed at letting operators learn more readily from each other’s encounters. How far that effort has actually changed practice on the ground remains an open question.
On the defense side of the house, a synchronization function the Pentagon designated in late 2024 now coordinates capability gaps across the services and elevates them for funding decisions. Add to this a Department of War (DoW) marketplace model designed to compress procurement timelines from months to weeks, a directed energy pilot program spanning a dozen states and a push to guarantee capability deployment within 120 days of a solicitation, and it is easy to understand the mood.
Officials describe counter-UAS now as a supply chain and manufacturing question, not a legal one. Build systems that work safely together, integrate them, and the mission succeeds. That mindset misses three things that keep surfacing every time this technology meets the real world.
The Jurisdictional Seams Nobody Has Closed
Counter-UAS in the United States still trips over jurisdictional lines drawn decades before small drones existed. A critical infrastructure facility can detect a threat, yet lack the authority to defeat it. The airspace above a stadium, water treatment facility or railway line answers to a different rulebook than the ground beneath it. The SAFER SKIES Act helped narrow that gap by extending detection and mitigation authority to state and local responders, but the law’s promise depends entirely on implementation. Dozens of agencies are still working through training and certification requirements tied to the interim rule that followed the law, and until that process matures, a state trooper responding to a drone incursion near a critical facility often has less practical ability to act than the statute technically allows.
The proposed FAA rule covering flight restrictions near critical infrastructure drew more than a thousand public comments. That volume alone signals unresolved tension. Sectors eligible for these protections expanded from a handful to all sixteen DHS-designated critical infrastructure sectors in the proposal. That expansive reach could result in hundreds of thousands of potential flight restriction decisions nationwide once finalized.
Data Sharing Rules Remain A Work In Progress
Ask anyone operating detection or mitigation systems what slows them down most, and classification and data handling rules repeatedly surface. A facility security team that spots a drone incursion often cannot pass that detection along to a neighboring agency, a state trooper, or even a different unit within its own organization, because the data itself carries restrictions nobody has fully sorted out. While agencies actively revisit how incursion data gets defined, anonymized and disseminated, that unresolved question shows up daily for the people actually running these systems in the field. One proposal would make critical infrastructure sharing an entirely new data category, distinct from the traditional split between public information and law enforcement records. Until that category gets defined, operators cannot know whether sharing a detection with a partner agency exposes them to liability. That uncertainty might result in some teams sitting on information they should be sharing.
Civil Enforcement Still Lacks Teeth
Even where authorities exist on paper, enforcement against unauthorized drone activity near sensitive sites remains thin. There is open acknowledgment that civil penalties and prosecutions need more momentum. Closing the loop on incident reporting systems also remains unfinished work. A detection capability paired with no meaningful consequence for the violator only goes so far as a deterrent. Enforcement infrastructure is policy infrastructure. It lags behind the sensors and effectors getting most of the attention.
What Genuine Progress Actually Looks Like
To be clear, none of this diminishes what has been accomplished. A marketplace model built to help smaller companies enter federal testing pipelines without upfront cost represents a meaningful upgrade in how the government engages industry. Flexible counter-UAS “flyaway” kits now let DoW regional commands respond within a day when a site requests additional coverage. Coordination between federal partners on counter-illicit-trafficking missions near maritime and border zones has matured into genuine joint operations rather than parallel efforts.
These are real wins, and the SAFER SKIES Act belongs at the top of that list. But real wins in legislative authority, acquisition speed and interagency coordination do not eliminate the policy layer. They shift it downstream, from broad authority questions toward the granular mechanics of implementation: how data gets classified, who bears liability for a mitigation decision gone wrong, which facilities qualify for airspace protection and how enforcement actually gets carried out once a violation occurs.
Critical Infrastructure Operators Need Clarity Now
Facility operators sitting outside the federal government face the worst version of this gap. They are being told to conduct risk assessments, document drone activity, adopt remote identification systems and prepare security plans that account for uncrewed threats, all while the FAA’s proposed rule governing flight restrictions near their sites remains unfinalized. Operators representing power generation, transportation hubs and major public events are effectively building compliance programs against a moving target.
A facility’s eligibility for airspace protection increasingly depends on scale metrics like electricity output or visitor counts, and the cascading consequences of an incident matter more than the immediate one. That is a sound approach conceptually, but it only works if operators know the final rule well before they need it, not after an incident forces the issue.
The Path Forward Requires Policy And Technology Together
Counter-UAS success in the coming years will not come from choosing between authorities and acquisition speed. It requires both, moving in step. Washington’s shift toward viewing this fight as primarily a manufacturing and integration challenge reflects genuine progress, anchored by the SAFER SKIES Act, on authorities that used to block basic capability deployment. But calling the authorities fight finished, while jurisdictional seams, data classification rules, sector eligibility definitions and enforcement mechanisms remain unsettled, sets expectations that outpace reality.
Technology is arriving faster than ever. That is worth celebrating. Systems are moving from demonstration to deployment in months rather than years, and directed energy, passive sensing, and networked command capabilities are converging in ways that finally make layered defense feasible. Yet capability without a truly finished “rulebook” creates its own risk, because operators and responders end up improvising in the middle of an actual incident. That improvisation is exactly what policy exists to prevent.
Counter-UAS remains, at its core, a policy problem wearing new clothes. The sooner Washington acknowledges that the fight has evolved rather than ended, the sooner critical infrastructure operators, state and local responders, and the industry building these systems can plan with the confidence this mission demands.