After the flight¶
The attacks end at different places. A receiver gets the feed, a jammer breaks the control link, a spoofing transmitter changes the position, Remote ID gives up a registration number, a detector receives a phone, and a network puts what its sensors saw into a shared picture. That is where the first impact happens, and for the pilot and the people under the drone it is over in minutes.
The second impact begins when somebody keeps the observation, attaches a name to it, combines it with another observation, or uses it to make a decision. The Commission’s action plan proposes something for each of the four, sensors that observe, a package that names the operator, a picture that combines, and a take-off condition that decides, and specifies no retention period, deletion rule or query right for the records that result.
On the day¶
A name for the aircraft¶
Remote ID broadcasts the drone’s serial number and position, the operator’s registration number and the pilot’s location, and a receiver takes all of it without touching the control link. The number is only a number until it reaches an authority with the registration record, which turns it into a person. The operator need not have been doing anything suspicious to arrive there: a camera drone surveying a roof produces the same registration number as one over an empty field.
The information path is:
drone → Remote ID → registration number → operator record → person
The impact is the attachment. Until the number is resolved the system sees an aircraft; after it, a person flying one, and every later flight is flown under that name.
The pilot’s flight stops being anonymous the moment the number is resolved. A journalist over a demonstration, a farmer over a field and a person filming a police line look the same to the receiver; to the authority holding the registry they are three named people.
A diary nobody kept¶
Remote ID also gives away the pilot’s location or the drone’s take-off point, and one observation gives one place. Repeated observations give:
operator A → Tuesday, 10:14 → site X, operator A → Tuesday, 15:37 → site Y, operator A → Friday, 09:02 → site Z
No single transmission contains a diary, and none needs to, because the diary can be made later from the records by anyone who holds them.
An operator who flies for a living gets a record of clients and sites. For one who flies over the same demonstration or the same factory fence it is a record of interest. Either can be read later by a police officer or a court that was not there.
Extras in the picture¶
The drone’s camera records whatever is in front of it, so a receiver that takes the video feed takes the people in the frame along with it, and the people in the frame have no way of knowing that a second receiver exists.
The path is:
camera → video link → receiver → screen
A journalist’s drone can therefore hand a crowd image to somebody who is not the journalist, a survey drone the roofers, a hobby drone the people on a beach, and the receiver has the picture without ever putting a camera of its own over the scene.
The people filmed are seen by a stranger who needed no camera of their own. A crowd that put up with a journalist’s drone has also been filmed for whoever holds the receiver, and cannot tell. For the journalist, protection of a source ends at the video link.
Received in passing¶
A detector looking for a drone receives whatever else is transmitting on the same bands, and on those bands that is phones, access points and headsets.
The path is:
phone / access point / headset → radio emission → detector
The Vydun receives them and its software classifies them as civilian before it drops them from the drone display; First Contact lists locating base stations among the FC.K’s functions. So the first impact on the bystander is not identification but reception: a person who never flew anything has entered the detector’s data stream.
For the bystander this is the first line of a file they never opened: a phone, a headset, a laptop, logged as present near a drone. Nothing is asked of them and nothing can be refused. If the observation is kept, they are a person at a place and a time, in a system built for something else.
A bird files a report¶
Every classification can be wrong, and the path runs the same way whether it is right or not:
signal → classifier → drone detection → alert
For the Rzeszow acoustic system:
sound → local model → drone classification → alert
A car, a bird, an aircraft or a loudspeaker becomes a drone event the moment the classifier gets it wrong, and the Rzeszow write-up has no false-positive figures yet. A false positive that stays in a test report is a number; one that enters an incident system is an event with a place and a time attached.
Whoever is nearest gets a false positive as an incident with their name on it, if any identifier was in range. For a council that bought the microphones it is an alert that costs a response. For the system it is a record that looks like all the others.
Promoted to incident¶
The proposed architecture combines what different sensors saw into one airspace picture and adds an incident platform, so the path grows a stage:
sensor → detection → location/time → airspace picture → incident
The signal at the start of that path may have lasted seconds. The incident at the end of it describes those seconds afterwards, to whoever may ask, and nobody has said who that is. That changes what exists: where there was a passing radio transmission there is now an event somebody can refer to.
For the pilot, an incident is a flight that has become someone else’s business. It can be queried, copied and cited, and the pilot is not told. For a journalist it is a record that a story was filmed from the air, held by the police or the ministry the story may have been about.
Somebody else’s hands¶
Jamming takes the pilot’s control away, joining the link replaces the pilot’s commands with somebody else’s, and spoofing changes where the aircraft believes it is. The immediate consequences are physical:
control lost → aircraft changes behaviour
control channel joined → legitimate pilot loses command
false position → aircraft changes course
Any of the three can end the flight, move the aircraft somewhere the pilot did not intend, or bring it over people and property it was never meant to cross, and none of them needs the operator identified first. The radio link is enough.
For the pilot, the drone lands where a stranger put it, or flies home, or crosses people it was never meant to cross. For the people under it, a drone with no pilot is a falling object. For a working operator a lost aircraft is the day’s income and the client’s footage.
Afterwards¶
History by accumulation¶
One Remote ID observation identifies an operator; a collection of them describes where that operator flies. Add incident records and the history becomes:
operator → flights → places → times → incidents
Add video and the record also holds what was happening at those places. The system can then answer a question nobody asked of any single flight. Instead of who is flying this drone, it can say where this operator has been flying, which is a new piece of information made entirely from old ones.
The operator acquires a profile: where they fly, how often, for whom. A wedding photographer’s history is harmless until it is read beside a demonstration. It can be asked for by a police force or a ministry that had no interest in any single flight.
A history without a name¶
A phone’s emission does not, by itself, tell the detector who owns the phone, but a persistent observation can still record:
device emission → place → time
If a mobile operator’s subscriber records or a police database can match that phone to its owner, the detector built to find drones has recorded where a named person was at a given time. Nothing published shows the systems in the cases making that association; what it shows is that the first observation exists, and the first observation is where the next system starts.
For the bystander the history has no name until somebody adds one, and the adding needs a system the detector does not have. The danger is the join: a phone seen near three drone incidents becomes a person of interest without ever having flown.
The join¶
Once the observations exist, the useful unit is no longer the detector but the join between detectors. Each one gives a piece:
Remote ID → operator number
detector → location
video feed → people
incident platform → event
Joined together:
operator → location → time → event → image
The Commission’s airspace picture is meant, in the release’s words, to integrate all relevant data, and that is what the join does: each source on its own reveals little, the combined record reveals more, and a set of ordinary observations becomes a map of who was where, when, and what the camera saw.
For everyone in it, the joined record says more than any of them agreed to: where a named operator was, when, what the camera saw, and whose phone was beside it. For the town it is a map of activity assembled from equipment bought to find drones.
The error finds an owner¶
Suppose a detector reports a drone where there is none. The bad path is:
false detection → incident → location → operator association
If Remote ID or any other identifier is then attached to the incident, the error has a subject. What began as the system thinking there was a drone becomes a record that this operator was involved in an incident here, and deleting the detector’s error afterwards does not remove the copies already sent on to another system.
The person attached to a wrong incident has no receipt to challenge. The detector’s error is corrected in one place and copied in another, and the copy is what a later query finds. The cost falls on whoever was nearest.
The aircraft leaves first¶
The aircraft leaves and the observation stays behind, along this path:
flight → sensor observation → airspace picture → incident record → retained data
The Commission’s three documents describe the systems and their uses and do not say how long any observation remains available, which leaves several things without an answer:
when the raw observation disappears;
when the classified event disappears;
whether an incident record survives after the incident closes;
whether filtered non-drone signals are deleted;
whether records can be copied into another system;
whether an operator can find out what was recorded.
A flight lasts minutes, and a record does not have to.
For operator, pilot and bystander alike, the record is the part that lasts. What it can do to them depends on who holds it and for how long, and both are unwritten, so the answer today is anything.
Grounds for refusal¶
The next system does not need to attack the drone at all; it can act on the record.
observation → record → decision → refusal
A proposed identification requirement could leave an operator unable to satisfy the conditions for take-off, a geographical restriction can keep a flight out of a zone, and a label could become a condition set by whoever sells, insures or services a drone. Each of them stops the drone without anyone deciding that this particular flight is dangerous, because the decision is a lookup:
identified / not identified
allowed / not allowed
labelled / not labelled
The machine supplies the fact and somebody else supplies the consequence.
For an operator without an accepted identity, a label or the right zone, this is a drone that will not take off, a sale that will not go through, an insurance that will not renew. For a journalist it is a story nobody the desk has not approved can film from the air.
Second-hand records¶
A system built to detect drones produces records about:
aircraft;
operators;
locations;
times;
incidents;
video;
radio emissions;
false detections.
Nothing in the sensor says what those records are for afterwards, so the secondary path is open:
drone detection → stored observation → different user → different purpose
The second use could be legitimate, or it could exceed the reason the observation was collected for; the architecture does not settle which, and only a retention rule, an access rule and a purpose rule would.
For the operator or the bystander, a record collected to find drones can be read for something else by an agency they never dealt with. What it can do to them is decided by the second purpose.
Staying on the ground¶
Once people know that flights are identifiable and observable, they change what they do: a journalist may avoid flying over a demonstration, a surveyor a site where interception is likely, a hobbyist may stop flying altogether, and a person being filmed may avoid the public place. None of that is a technical failure; the system works as designed and behaviour changes anyway. The effect is larger when identification is persistent, because the choice is then no longer whether to fly but whether to add another entry to a history attached to a name.
Journalists, surveyors and hobbyists pay in flights not flown and stories not filmed; people in public places pay by being elsewhere. The town loses the pictures.
Left blank¶
Who receives the raw signal?
Who receives the classified event?
Who can see the operator number?
Who can resolve it to a person?
Who can query previous flights?
Who can join two observations?
Who can retrieve a rejected non-drone signal?
Who can export an incident?
How long does each record remain?
When is each copy deleted?
Can another authority use the record for another purpose?
What happens when the system is wrong?
What happens when a person is wrongly attached to an event?
The action plan describes a larger detection and response system, and the EASA security opinion of 18 September 2026 proposes that Member States verify an operator’s identity before registration and lowers the mass threshold for registration and direct Remote ID from 250 g to 100 g. Both increase the amount of information that can be attached to a flight, and neither, by itself, says who gets to remember it.
Last reviewed: 2026-09-25.