Eight ways down¶

D1. Watch the feed¶

Attacker action	Target	Result
Tune a receiver to the drone’s video frequency	Video transmission	Receiver gets the camera feed
Receive the analogue feed from up to four kilometres	Vydun 7.5 target	Someone other than the pilot sees what the camera sees

The Vydun 7.5 receives analogue video links at up to four kilometres. The Vydun 8.5 gives four kilometres on its lower bands and three on its highest listed band. Neither is claimed to receive the digital links other drones use.

The attack does not need access to the drone or its operator. It needs a receiver in range of the transmission.

D2. Jam the link¶

Attacker action	Target	Result
Transmit interference on the control frequency	Pilot-to-drone control link	Drone stops receiving commands
Keep transmitting interference	Loss-of-link state	Drone follows its programmed response

First Contact claims the FC.K detects and jams control, video and telemetry. Later variants cover 20 MHz to 6 GHz.

The jammer does not need to identify the drone. It attacks the radio channel.

The drone’s response is a separate part of the attack. The EU class rules require a “reliable and predictable” response to a lost control link, but the manufacturer chooses it: landing, return-to-home, hover or another programmed response, depending on the aircraft.

D3. Join the link¶

Attacker action	Target	Result
Speak the drone’s control protocol	Drone control receiver	Drone accepts attacker’s protocol messages
Send commands through the accepted connection	Drone	Original operator loses the command path

Contra-drone claims its D-JACK can connect to analogue FPV links within about one kilometre and make the drone stop accepting commands from its original operator.

This is not the same attack as jamming. A jammer prevents the legitimate message arriving. Contra-drone claims it sends a message the drone accepts.

The published D-JACK material does not demonstrate the attacker flying the captured drone. SkyJack demonstrated takeover of Parrot drones in 2013 and of 3DR telemetry radios in 2015.

D4. Spoof the position¶

Attacker action	Target	Result
Transmit false satellite-navigation signals	Drone GNSS receiver	Receiver calculates a false position
Change the false position gradually	Flight controller	Autopilot treats the false position as navigation
Continue the false signal	Flight path	Drone turns, circles or follows the spoofed position

A Russian account in Argumenty i Fakty describes gradual spoofing intended to make the autopilot treat the false position as a correction to its course.

The control link can remain available throughout. The attack changes what the aircraft believes about where it is.

D5. Read the operator¶

Attacker action	Target	Result
Receive Remote ID	Drone broadcast	Receiver gets serial number, position and operator information
Match operator registration number to a registration record	Operator record	Operator can be identified
Associate repeated observations	Operator identity and locations	Movements can be associated with the same operator

Remote ID broadcasts the drone’s serial number and position, the pilot’s position or take-off point, and the operator’s registration number. A phone app or an ESP32 receiver can receive it.

The broadcast contains an identifier, not the person’s name. An enforcement authority, which holds the registration record, performs that second step.

The proposed package would make operator identification a condition of take-off. The stated gap is the small camera drone below 250 grams, which can operate without broadcasting Remote ID under current European rules.

D6. Receive the bystander¶

Attacker action	Target	Result
Sweep the drone’s radio bands	Phones, access points, headsets and other transmitters	Their emissions enter the receiver
Classify received signals	Non-drone emissions	Software filters them from the drone display
Pass received observations elsewhere	Unknown	Potential record of people near the drone

The Vydun receives signals before filtering phones, access points and headsets from its display. First Contact lists locating base stations among the FC.K’s functions. The Commission’s proposed 5G sensing would detect drones “connected or not”.

The attack is to receive the bystander’s transmission, not to identify the bystander. The published material does not establish what happens to that observation after the detector decides it is not a drone.

D7. Keep the observation¶

Attacker action	Target	Result
Send sensor observations to an airspace picture	Sensor observations	Observations become part of a shared system
Send an incident to an incident platform	Incident data	Event information becomes available to another system
Retain observations after the flight	Sensor and incident records	Information about the flight survives the flight

The airspace picture and the incident platform are in the Commission’s documents. Retention after the flight is not.

They do not specify retention periods, deletion, query rights, or whether observations rejected as “not a drone” remain available.

The attack is not demonstrated. What is missing is the rule for who may keep the observation once it exists, retrieve it, and combine it with others.

D8. Refuse the drone¶

Actor action	Target	Result
Require operator identification before take-off	Drone operation	Unidentified operator cannot satisfy the proposed condition
Apply a geofence	Drone flight	Drone cannot enter the restricted area
Require a Trusted Drone Label before sale or service	Purchase or service relationship	Intermediary can refuse the transaction

Identification and the geofence are proposed technical or regulatory controls. The label depends on an intermediary choosing to require it.

A retailer or insurer does not need to establish that a particular drone is dangerous. If the label becomes a condition of the transaction, absence of the label is enough to refuse it.

Last reviewed: 2026-09-25.