Spotlight on Surveillance - October 2014

DRONES: Eyes in the Sky*

I. Introduction

EPIC’s Spotlight on Surveillance project explores the privacy and civil liberties implications of domestic drone use. The term “drone” describes any remotely controlled unmanned flying vehicle regardless of size, use, or on-board technology, from 15-ton Global Hawks used by the U.S. military to palm-sized rotary-wing vehicles used by hobbyists. Domestic use of drones by the government and private citizens has increased substantially in the past several years, with Congress requiring full integration of drones into the national airspace by late 2015. However, drone use remains substantially unregulated, with no privacy and civil liberties restrictions at the federal level and only a patchwork of laws at the state and local levels.

The Federal Aviation Administration (“FAA”) is currently the only federal government agency regulating the domestic use of drones. The agency’s primary focus is public safety because of risks arising from air-based collision with commercial aircraft as well as crashes and other risks to public safety. All non-recreational drone users—including government agencies and civilian organizations—must obtain certificates prior to flight. Use may include research, demonstration, training, and law enforcement activity. As detailed in this report, however, the FAA works to promote airspace safety and currently plays no role in regulating what technologies, including surveillance technologies, drones can carry or what operations drones can conduct.

Under the FAA Modernization and Reform Act of 2012, the FAA must “provide for the safe integration of civil unmanned aircraft systems into the national airspace system” by September 30, 2015. [1] As a first step, the FAA has authorized the creation of six test sites around the United States that will conduct research into how drones can be safely integrated into the national airspace. [2]

The development of both sophisticated drones and the invasive surveillance technologies they carry has significantly expanded the amount of sensitive, personal data that can be collected by governments, private companies, and individuals. Drone technology threatens to facilitate massive, pervasive, and dragnet government surveillance by making surveillance easier to conduct and less expensive. Unregulated private and commercial drone use could destroy the personal privacy and practical anonymity that we enjoy today. Courts, government agencies, and legislatures must embrace thoughtful, farsighted drone regulations that protect privacy and civil liberties.

This report will address the recent developments in drone and drone surveillance technologies; explore examples of government, commercial, and private drone uses; and discuss drone regulation (and lack thereof) at the federal and state level. The report will conclude with a summary of major privacy and civil liberties concerns arising out of increasing drone use and EPIC’s recommendations.

II. Drone Surveillance Technology

The history of unmanned aerial vehicles dates back to at least the American Civil War, during which Union and Confederate troops attempted to use unguided balloons to send bombs over enemy lines. [3] The development of drones, or more specifically, the systems attached to drones, has accelerated significantly since September 11, 2001. EPIC’s August 2005 Spotlight on Surveillance[4] examined drone technology during its infancy, but the surveillance capabilities of drones have expanded.

Given the advances in surveillance technologies, a drone’s payload implicates privacy more than the drone itself. Among the new drone systems is ARGUS-IS (Autonomous Real-time Ground Ubiquitous Surveillance Imaging System). [5] ARGUS-IS is a sophisticated system that combines the images of 368 consumer-grade five-megapixel smartphone camera sensors into a single 1.8 gigapixel image, [6] making it the world’s highest-resolution camera. [7] According to Yiannis Antoniades, an engineer who developed ARGUS-IS, “You can see individuals crossing the street. You can see individuals walking in parking lots. There is actually enough resolution to be able to see the people waving their arms, or walking around, [or to see] what kind of clothes they wear.” [8]

ARGUS-IS can process images into a massive video stream. ARGUS-IS shoots twelve frames per second, covering between ten to twenty square miles. [9] “ARGUS streams live to the ground, and also stores everything”—up to a “million terabytes of video a day.” [10] The video is compressed for more efficient storage, [11] and with the archive ARGUS-IS generates, “you can go back and say ‘I would like to see what happened at this particular location three days, two hours, four minutes ago,’ and it would actually show you exactly what happened as if you were watching it live.” [12] In addition to its ability to capture and store video, ARGUS is backed by powerful image processing software, which can automatically track every moving object within its vast gaze. [13]

With the introduction of infrared sensors[14] and requests by DARPA for even higher resolution cameras, [15] the only limit on ARGUS’s ability to engage in surveillance is how long it can stay in the sky. Funded through DARPA’s “Vulture II” program, [16] Boeing aims to dramatically increase the length of time that a drone can remain airborne by developing the SolarEagle. The SolarEagle is a solar-powered drone that will, if successful, be able to “remain on station at stratospheric altitudes for at least five years.” [17] While ARGUS-IS will be (or is) likely deployed on the MQ-1 Predator drone, because ARGUS-IS is developed independently from any platform, nothing prevents the system from operating on the SolarEagle[18] or the helium-filled unmanned aircraft called JLENS. [19]

Researchers are also working to combine drones with facial recognition technology. [20] At Carnegie Mellon University, researchers have used a small drone to capture images of faces, while a separate team “has conducted experiments that matched photos of students on campus with their Facebook profiles¬—and then predicted their interests and Social Security numbers.” [21] In 2011, the Army developed a system that could create a 3D model of a face with low-resolution photos, supplementing that system with “soft biometrics” including skin color, height, and weight. [22]

III. Government Use of Drones

Federal Government

Military and non-military government use of drones in the United States has increased dramatically in the past decade. The U.S. military “owns about 10,000 drones, from one-pound Wasps and four-pound Ravens to one-ton Predators and 15-ton Global Hawks.” [23] Within three years, military drones will operate from “at least 110 bases in 39 states, plus Guam and Puerto Rico,” [24] and from as many as “144 U.S. locations.” [25]

Federal, state, and local government agencies must obtain a Certificate of Authorization or Waiver (“COA”) from the FAA to operate drones in the national airspace. [26] As of April 2013, the Department of Defense (“DoD”) has 161 COAs to operate drones in shared national airspace. [27] Domestic use of military drones appears currently limited to training exercises, but the DoD expects “to receive more requests from civil authorities to deploy drones during natural disasters and other emergencies” in the coming years. [28]

CBP owns the federal government’s largest and most sophisticated drone fleet outside of the DoD, including nine[29] unarmed Predator B drones operated from bases in Arizona, Texas, Florida and North Dakota. [30] CBP’s drones operate in a 25-mile corridor along the Canadian and Mexican borders, “as well as over the Caribbean Sea and Gulf of Mexico.” [31] CBP drones employ a system called VaDER, which can “cover a wide swath of land and follow [a person’s] movement as it happens.” [32] In February of 2013, EPIC obtained documents under the Freedom of Information Act that showed the performance specifications for CBP drones required that the drones be able to detect and intercept wireless signals.

The performance specifications obtained by EPIC also indicated the requirement to track human targets automatically.

After FOIA documents obtained by EPIC revealed the capabilities of CBP drones, the agency released in the Fall of 2013 a Privacy Impact Assessment (“PIA”) for its use of drones. The PIA states that CBP drones are equipped with optical and infrared cameras that “take small-scale aerial video images of buildings, vehicles, and people,” a Wide Area Surveillance System that detects persons and vehicles along the Mexican border, “synthetic aperture radar that can provide black and white images in all weather,” and Law Enforcement Technical Collection sensors to “detect electronic signals in the electromagnetic spectrum.” [33]

CBP regularly conducts drone surveillance operations for other federal, state, and local government agencies, including the U.S. Coast Guard, Immigration and Customs Enforcement, the Drug Enforcement Administration, and a number of county sheriff’s offices. [34] CBP conducted at least 687 flights for other government agencies between 2010 and 2012. [35]

Documents obtained by EPIC under the Freedom of Information detail a new surveillance systems that will deploy over the Washington metropolitan area known as the Joint Land Attack Cruise Missile Defense Elevated Netted Sensor Systems (“JLENS”). [36] JLENS is a two-blimp system developed by defense contractor Rathyeon, in which one blimp provides 360 degree radar surveillance over hundreds of miles and the other houses missiles. The blimps have been tested and the Army plans to launch them from Maryland in October 2014 to surveil Washington, D.C. and much of the eastern seaboard. Following the disclosure of the documents to EPIC, the Army stated the system would only be radar-based and not include a video surveillance systems capable of recording and identifying individuals on the ground even though that specific capability for JLENS was showcased by Raytheon in 2013. [37]

State and Local Government

The use of drones by state law enforcement is expanding, but growth has been limited by public backlash and federal and state regulation. It is difficult to fully assess the drone capabilities of law enforcement agencies, because of the complex relationships of the local, state and federal agencies involved and a general lack of transparency. Efforts to track drone proliferation often must rely on investigation and freedom of information requests by outside groups, rather than voluntary and transparent disclosures by government. [38]

Local law enforcement can apply for funding from federal agencies such as the Department of Homeland Security (“DHS”) to purchase drones and train pilots. [39] Police departments in Texas, Washington, Arkansas, Alabama, Florida and Idaho have purchased drones with federal funds. [40] And once a department acquires a drone, the cost of operation can be very low. The police department in Mesa, Colorado estimated that their drone costs only $25 per hour to operate. [41] In addition to outside funding, the rapidly diminishing price of drone technology has made the devices feasible for local departments. [42]

Local law enforcement departments have found a variety of different uses for these drones. In Montgomery County, Texas, the Sheriff’s Department has equipped its 50-pound ShadowHawk drone with night vision cameras and infrared sensors to assist SWAT teams and locate suspects in real time. [43] Some police insist that the greatest value of law enforcement drones is documenting crime scenes and preserving evidence for trial. [44] Other police limit use to fire spotting and search and rescue. [45]

Indiscriminate surveillance remains a goal for some in local government. Former New York City mayor Michael Bloomberg stated that it was inevitable that surveillance drones would come to serve as more effective versions of current security cameras. [46] Ogden, Utah, a city of over 80,000, applied to the FAA for certification to fly an unmanned blimp above the city to perform 24 hour surveillance in “high crime areas” in order to both deter and investigate crime. [47] That application was denied by the FAA for air traffic safety reasons, [48] but a safer system with the same surveillance capacity could potentially be approved.

Long-term, aerial surveillance to deter crime is not a unique or hypothetical proposal. Police departments in Baltimore, Md., Philadelphia, Pa., Compton, Cal., and Dayton, Ohio have recently hosted demonstrations by a company offering aircraft-mounted aerial cameras that can track the movement of every vehicle and individual in a 25 square mile area. [49] Although the cameras are currently used on planes, with the proper regulatory certification, the cameras could be placed on drones for long-term, indiscriminate surveillance.

As drones have become less expensive and more accessible to local law enforcement, local officials across the country considering drone programs have faced public outcry. The mayor of Seattle halted the city’s drone program, which had been partially funded by DHS grants, and returned the drones to the vendor, stating that drone surveillance would detract from the law enforcement goal of “community building.” [50] After a local news channel filmed a police drone demonstration, the Houston police department discontinued its drone program. [51] Other departments have avoided investing in drones or stopped using already-purchased drones out of fear of public backlash. [52]

Potential public backlash has not stopped state and local law enforcement from requesting that DHS drones perform missions on their behalf. The CBP performed 94 drone missions for state and local agencies between 2010 and 2012, but the CBP has not revealed for which law enforcement agencies. These joint efforts lack transparency, [53] a particularly troubling aspect given that these missions are for standard law enforcement rather than more sensitive national security missions.

Drone use by local and state law enforcement remains sporadic and new. Despite the newness and controversy, the state and local entities that use drones generally lack any assessment of the privacy implications of drone use and have not been transparent about their drone operations with the public.

IV. Private Drone Use

Commercial Drones

Although drone use has accelerated throughout the world, the United States has placed restrictions on the use of drones for commercial purposes. [54] The FAA currently prohibits commercial drone, but under the FAA Modernization and Reform Act of 2012 (“FAA MRA”) must allow for the integration of commercial drones by the end of 2015. [55]

The FAA has recently made a few exceptions to its commercial band on drones, approving several drones for commercial purposes—one for surveys and emergency assistance off the Alaskan coast, [56] and one to survey oil fields in Alaska. [57] More recently, the Federal Aviation Administration granted six exemptions for the commercial use of drones to companies in the film and television industry. [58] Notably, large corporations such as Amazon, DHL, and Domino’s Pizza have announced intentions to develop drone services, but are not currently authorized to implement their use.

Although commercial drones in the United States remain restricted, experts estimate that the worldwide market for drones was $89 billion in 2013. [59] With so many companies poised to integrate unmanned flight into their business models, it is highly likely that once the regulatory pathway is well established, commercial drone use will rapidly expand.

Model Drones

With the rapid rise in sophisticated drone technology, an increasing number of small drones are landing in private hands. [60] Model drones have a number of uses, including recreational flight, aerial photography, [61] search-and-rescue operations, [62] 3D mapping, [63] and agricultural monitoring[64]—provided that the drone offers no direct or indirect commercial benefit. The only legal difference between model drones and their government and commercial counterparts is pecuniary use: model drones must be used for hobby or recreational purposes only (coupled with several other safety-based limitations).

V. Federal Regulation of Drones

The FAA is the only government agency regulating the operation of drones. The FAA considers drones to be “aircraft[s]” [65] and thus subject to FAA oversight and enforcement. The FAA currently prohibits unauthorized drone use and has established different usage authorizations for governmental, civil (non-governmental), and model drones. [66] Due to its emphasis on safety and efficiency, [67] however, FAA guidance and regulations focus almost exclusively on how drones should operate in the national airspace; the FAA does not regulate what technologies drones can carry or what operations drones can conduct.

Government and Civil Use

The FAA requires federal, state, and local governmental agencies to apply for a Certificate of Authorization or Waiver (COA) in order to operate a drone in the United States. [68] According to the FAA, agencies typically apply to use drones for “law enforcement, firefighting, border patrol, disaster relief, search and rescue, military training, and other government operational missions.” [69] The FAA has issued nearly 1,400 COAs since 2009; as of late 2013, 545 COAs were active. [70]

Besides a few exceptions, the FAA has wholly restricted civil drone use unless the drone pilot operates a model drone or obtains a special airworthiness certificate. [71] The majority of civilian drone operators obtain experimental airworthiness certificates, which “preclude carrying people or property for compensation or hire, but do allow operations for research and development, flight and sales demonstrations and crew training.” [72] In December 2013, the FAA authorized the creation of six test sites around the United States that will conduct research into how drones can be safely integrated into the national airspace. [73]

After an EPIC-led coalition petitioned the FAA to conduct rulemaking with respect to privacy regulations, the FAA requested public comment and eventually issued final privacy requirements for the six drone test sites in November 2013. [74] The final policy requires drone test site operators to create publically-accessible privacy policies informed (but not governed) by Fair Information Practices, to create a mechanism to review public comments about these privacy policies, and to conduct open annual reviews of drone test sites to ensure compliance with these policies. [75] The FAA adopted several EPIC recommendations, including requiring the test site operator to maintain a record of all drones operating at the test site and to require each drone operator to develop a written plan for the use and retention of data collected by the drone. [76] Unfortunately, the FAA abdicated any larger role in developing specific privacy requirements for drones, reiterating several times that its mission is safety, not the regulation of privacy “or the scope of data that can be collected by manned or unmanned aircraft.” [77]

Model Drones for Private Use

Under the FAA Modernization and Reform Act, a model aircraft is an “unmanned aircraft” that flies within the visual line of sight of its pilot for purely hobby or recreational purposes, regardless of whether the drone carries sophisticated surveillance capacities or conducts operations that impact personal privacy. [78] Current federal law defines and limits model drone use based on the hobbyist’s use rather than the drone’s size or capabilities.

The FAA has issued several guidance documents regulating model drones, but whether the FAA actually has the legal authority to enforce its guidance concerning model drone operations is unclear. A recent ruling by the National Transportation Safety Board (“NTSB”), however, suggests otherwise. [79] In Huerta v. Pirker, an Administrative Law Judge (“ALJ”) dismissed a $10,000 FAA penalty against Raphael Pirker for operating a drone recklessly and for commercial purposes. The ALJ held that model drones are not “aircraft” (and thus not subject to the Federal Aviation Regulations regulating safe flying procedures), and that FAA guidance dating back to 1981 does not create a legal basis for enforcement action. [80] Although the FAA has appealed the decision to the full NTSB and continues to assert its authority to regulate model drones, the legal authority for its oversight and enforcement actions remains uncertain. [81]

Federal Legislative Efforts

Congressional efforts to regulate drone use have gained little traction. In the 113rd Congress, Senator Rand Paul and Representative Austin Scott have introduced legislation to prohibit the government from gathering evidence for criminal conduct or civil violations without a warrant under the Fourth Amendment. [82] Senator Ed Markey and Representative Peter Welch introduced a bill that would also require a warrant for law enforcement drone use and would require all drone approval applications to describe what data will be collected; the bills have been referred to committee in the House and Senate. [83] EPIC testified before Congress in March of 2013, emphasizing the inadequacy of current drone regulations and advocating for responsible drone legislation. [84] EPIC specifically recommended use limitations, data retention limitations, and mechanisms for transparency and oversight including third party audits of law enforcement drone operations.

VI. State Regulation of Drones

Since the February 2012 FAA MRA, drone legislation has exploded at the state level. [85] Thirteen states have enacted laws regulating drone use and 29 more states have had proposed legislation. [86] State drone legislation has varied greatly in scope and focus. Broadly, there have been three types of state drone regulations enacted: first, drone moratorium laws designed to give legislators time to observe the progression of drone technology and draft sensible regulations; second, laws addressing law enforcement use of drones; and third, laws addressing both law enforcement and private use.

VII. EPIC’s Work

EPIC is a leader in the fight to protect the privacy interests threatened by drone use. In 2005, EPIC published its first Spotlight on Surveillance report exploring the significant privacy impact of the then-emerging drone technology. [100]

In February 2012, EPIC led a coalition of more than one hundred members of the public and consumer rights, human rights, technology, and civil liberties organizations in petitioning the FAA to conduct a rulemaking. [101] In response, the FAA published a notice of proposed privacy policies to govern the operation of drones in the six test sites. [102] EPIC submitted comments recommending that: (a) all authorized drone operators be listed in a public database, (b) test site operators comply with Fair Information Practices, (c) the FAA require drone operators to disclose data collection and minimization practices, (d) drone operators be subject to independent auditing to ensure compliance with represented privacy policies. [103]

EPIC has also organized a petition to the CBP, demanding that the agency’s drone program be suspended until it had performed public rulemaking under the Administrative Procedures Act. [104] The CBP’s drone programs, which the agency asserts may perform surveillance anywhere within 100 miles of a border, have never undergone public rulemaking. [105] EPIC, and a coalition of organizations and individuals, have called on CBP for greater recognition of the vast privacy implications of drones and transparency in its drone policies.

In addition, EPIC has testified before congressional committees on drone privacy issues. In July 2012, Amie Stepanovich, Director of EPIC’s Domestic Surveillance Project, testified before the House Committee on Homeland Security’s Subcommittee on Oversight, Investigations and Management on the unique threats of drones and the lack of legal oversight. [106] EPIC stated that “there are substantial legal and constitutional issues involved in the deployment of aerial drones by federal agencies” and the current legal regime is inadequate to address those concerns. [107]

VIII. Privacy and Civil Liberties Concerns: Old Problems, New Numbers

The capacity to perform aerial surveillance is not new. However, the economics of aerial surveillance have changed dramatically. Low-cost drones, coupled with leaps in camera technology and cheap data storage, create the capacity for pervasive and indiscriminate surveillance. Surveillance technology is now economically and practically feasible for even small police forces. Quite simply, while the problem of aerial surveillance is quite old, the economic realities of the past served to limit the scope of the surveillance.

In the past, a city police force could deploy an airplane or a helicopter with a camera attached to engage in surveillance, but the costs of fuel, a pilot, and video storage would have limited the time such a system remained in the air. Now, for the cost of a single police helicopter, a force could deploy dozens of drones. This capacity creates a host of dangers to civil liberties.

Indiscriminate surveillance of an area may capture all of an individual’s movements. The Supreme Court has recognized that this type of data has the potential to reveal the most intimate details of one’s life. [108] Drone technology, such as ARGUS-IS (see above) can track the movements of tens of thousands of individuals at once. This has obvious implications for First Amendment rights, including the right to free association, the right to freely exercise of one’s religion and the right to speak anonymously. It also could threaten a more basic sense of privacy in a free society: the right to live without constant observation by the state.

Additionally, the profit-motive of government drone contractors can create problematic incentives that could threaten privacy. When the government outsources law enforcement functions—such as the private ownership of stoplight cameras[109]—private companies are motivated to track the crimes that are the most profitable rather than the crimes that are the most dangerous. Punishing petty infractions such, as jay-walking, littering, and smoking in undesignated areas does not warrant dragnet surveillance of all public behavior.

The proliferation of private drones could also have legal implications that make government surveillance more pervasive. For instance, if a drone producer offered cloud storage for information captured by private drones, that information could potentially be collected by the government without a warrant. And under some approaches to Fourth Amendment law, increased drone use by the public could mean that individuals have a reduced expectation of privacy with regard to government drone surveillance. [110]

The threat that unregulated drone use poses to civil and constitutional rights is not conjecture. The capacity for indiscriminate surveillance exists. These programs could collect information on the actions of every citizen, without regard to suspicion or any connection to a crime. Law and public policy, at every level of government, must adapt to these technological advancements to ensure that the technical feasibility of a security state does not lead to the creation of one.

Private drone use creates many other privacy concerns. Information generated by location tracking of individuals could be valuable to advertisers and data brokers, and the technical capacity for such surveillance exists today. Commercial data collectors may soon have the capacity to continuously track the movements of individuals in public spaces just as they now track online activity. Both Google and Facebook have recently acquired drone companies, raising concern that the companies may further expand their surveillance activities into the physical world. [111]

Regulation of private drone use must be crafted with a recognition that drones not only make possible new types of crime, but make it much easier to commit others. Just as problems of stalking have become more prolific in the online context, a jealous ex or a grudge-holding competitor could deploy his personal drone to follow someone throughout her day without leaving his desk. Offenses like stalking, harassment, blackmail, and invasions of privacy could be committed more easily, covertly, and anonymously with the use of drones. Law enforcement will need to adopt strategies to counter this trend. In short, drones make it easier for citizens to invade each other’s privacy, both in ways that current laws recognize and in others that it does not.

IX. Recommendations

Legislation on drone use by law enforcement should ensure that all drone surveillance requires a warrant or a narrowly tailored emergency exception. Laws should also create data retention limits for information collected by drones and minimization for information collected outside the scope of the warrant. Government access to third party drone data should also require a warrant, so that the government cannot avoid obtaining warrants by collecting drone surveillance data from the private sector.

Federal agencies must be transparent and held accountable for their domestic use of drones. Agencies should provide clarity around the data collected, how it is used, and how long it is retained. Local and state agencies should provide similarly information to the public whether they are using drones directly or indirectly through federal agencies. All law enforcement agencies should publicly disclose the scope and purpose of the missions it performs.

Courts must adapt constitutional jurisprudence to properly address modern technology. The fact that it is now feasible to cheaply perform surveillance on an individual or entire area of individuals should not mean that these actions are constitutional. Particularly when surveillance is conducted on the property of another, or in areas where people would have an expectation of privacy or at least an expectation that they will not be subject to covert observation and recording, sanctions should be imposed.

Lawmakers should be concerned with changes in technology that allow commercial or private actors to gather data on or track the movements of individuals. These technological changes mean that individuals need laws to protect their dignity, autonomy, and privacy. At the same time, lawmakers must be cognizant of the fact that there are numerous legitimate uses for drone technology, including public safety and emergency response.. As such, laws passed in an effort to protect victims and consumers must be carefully tailored to separate innocent photography and exploration from stalking, harassment, and the commodification of our personal lives.