Big ears¶
Nobody who listens to a drone needs the pilot’s consent. A neighbour, an army, a ministry, a network operator, a manufacturer and a foreign state all hold antennae, and the same signal arrives at each of them with a different reason for listening to it.
The listener with the most antennae would be the one the Commission proposes: the 5G network.
The agencies¶
The action plan asks each Member State to appoint a National Drone Security Coordinator, calls for joint procurement of counter-drone systems, proposes Rapid EU counter-drone reaction teams, and keeps Frontex supplied with drones for border surveillance.
The plan gives as reasons the nine airports disrupted in three months and a utility reporting 1,300 overflights. The sensing would run on the mobile network operators’ base stations, the antennae on masts and rooftops. The Commission’s tender to test it live is for Member States and industry together. A mobile operator would then be a party to the grid: its base stations do the sensing, and what they sensed goes into the airspace picture.
The industry the plan pays for¶
Babai makes the Vydun. First Contact makes the FC.K, seventy of them with a German partner. Contra-drone makes the D-JACK. The EUDIS hackathons add lasers, turrets, interceptors and sensor grids from eight countries, on top of Ukraine’s fifty manufacturers.
The plan names the European Defence Fund and three other funds as sources of money, points to the Drone Alliance with Ukraine for affordable technology, brings industry together through a D-TECT forum, and proposes certification for counter-drone systems and an EU Trusted Drone Label for drones. Another compliance circus.
The label would put another condition between a drone and its use. A retailer, insurer or other intermediary could check it before doing business. The drone would not have to be dangerous. It would only have to lack the label.
Anyone with an antenna¶
The Vydun is a handheld whose battery lasts five to eight hours depending on the model. The D-JACK weighs three kilograms and hangs in a tree. Both cost less than a small car. The Rzeszow mesh is microphones, cheap radios and a model that runs on the node.
Software and knowledge are relatively cheap too. Awesome-Drone-Hacking lists a Docker simulator to practise on, Remote ID spoofing tools, telemetry eavesdroppers, a DJI DroneID decoder, SkyJack and MAVSploit, and DroneSecKB keeps a register of drone CVEs refreshed from the NVD every six hours. A neighbour with an antenna, a receiver and software can watch a feed, join a link and read a beacon. What the neighbour cannot do is turn a number into a name, sense every phone in a city from the mobile network’s base stations, or keep the record. Those take the registry, the network and the platform.
A hacker takes questions¶
A hacker calling himself PalachPro told Argumenty i Fakty in January 2026 that his group hijacks Ukrainian drones through holes in their control protocols. It also turns them around by feeding them false coordinates a little at a time, “smart spoofing” in his words. Starlink terminals, he claimed, are found by direction-finding to within ten metres and handed to artillery: “active terminals become radio beacons”.
Argumenty i Fakty has been Moscow city hall’s since 2014, and the interview checks nothing he claims. The chain it describes runs from a radio emission to a direction-finding fix to a location to artillery. The grid also uses a transmitter as a location.
Attack |
A neighbour with an antenna |
Ukraine’s armed forces |
A Member State agency |
A network operator |
The industry |
Russia, by its own account |
|---|---|---|---|---|---|---|
D1. Watch the feed |
a Vydun |
a Vydun |
whatever the €250 million buys |
Babai makes it |
intercepts FPV video channels |
|
D2. Jam the link |
a jammer built from a microwave oven |
an FC.K |
whatever the €250 million buys |
First Contact makes it |
lands their tactical copters |
|
D3. Join the link |
a D-JACK, SkyJack |
a D-JACK, under combat testing |
whatever the €250 million buys |
Contra-drone makes it |
protocol weaknesses |
|
D4. Spoof the position |
“smart spoofing” |
|||||
D5. Read the operator |
the number and the position, from an ESP32 or a phone app |
the number turned into a name |
||||
D6. Receive the bystander |
the Vydun’s sweep |
the FC.K locating base stations |
5G sensing |
5G base stations as radar |
Starlink terminals direction-found to ten metres |
|
D7. Keep the observation |
the incident platform, the airspace picture |
|||||
D8. Refuse the drone |
the package’s safeguard, a geofence |
a retailer or an insurer that could refuse an unlabelled drone |
Last reviewed: 2026-09-25.