As unmanned aerial systems (UAS) become a staple in modern public safety, their integration has outpaced the bureaucratic and technical maturity required to manage them. While departments are quick to tout the life-saving potential of drones, they often stumble in the shadows of oversight, compliance, and cybersecurity.

Nick Donarski, CTO at RotorLab, recently sat down with Help Net Security to dismantle the common misconceptions surrounding drone program management. His insights offer a sobering look at how police departments, fire services, and municipal agencies are failing to treat their aircraft as the complex, data-heavy assets they truly are.

Main Facts: The Compliance Gap

The central issue plaguing drone programs is a fundamental misunderstanding of what constitutes "documentation." Many agencies treat drones as "shiny gadgets" rather than highly regulated evidence-gathering tools.

Donarski highlights that elected officials, records clerks, and insurers operate on vastly different priorities. Councils care about liability mitigation and avoiding negative headlines; records clerks struggle with the logistical nightmare of FOIA requests; and insurers demand cold, hard proof of maintenance and pilot certification to justify coverage. When a program fails to bridge these gaps, it invites catastrophic legal and financial risks.

Chronology of Failure: From Takeoff to Litigation

The lifecycle of a drone mission is often where the most significant errors occur. The process, as outlined by Donarski, typically unfolds in three stages:

1. Pre-Flight Negligence: Agencies often skip the foundational work—the written policy. Without established Standard Operating Procedures (SOPs), flight triggers, and data retention schedules, a department is essentially flying blind.
2. In-Flight Data Mishandling: Operators frequently record non-stop during transit, capturing sensitive private data (backyards, pools, private property) that becomes a massive liability under public records laws if an auto-delete policy isn’t in place.
3. Post-Flight Incompetence: The "chain of custody" is frequently broken. Pilots fail to tag batteries, neglect to note call numbers, and store raw video files in unindexed, unencrypted desktop folders. When a defense attorney requests flight telemetry six months later, the department finds itself unable to provide a cohesive, verified record of the mission.

Supporting Data: The Cybersecurity Threat Landscape

From a cybersecurity perspective, Donarski warns that drone ground control stations are "massive, wide-open surfaces" that are often treated like consumer toys.

The Weakest Links

• Operating System Vulnerabilities: Most ground stations utilize standard tablets (iOS or Android). These devices are programmed to sync with cloud services, meaning coordinates, waypoints, and video metadata can leak to third-party servers without the pilot’s knowledge.
• Network Insecurity: Pilots frequently connect controllers to public Wi-Fi or unsegmented municipal networks to update maps. This creates a bridge that could allow malicious actors to pivot from the drone controller directly into an internal city network.
• Data Integrity: Perhaps the most alarming practice is the use of Excel spreadsheets for flight logs. Because these files lack audit trails, they are easily tampered with. In a court of law, a spreadsheet is considered worthless for evidentiary purposes.

Official Responses and Regulatory Realities

The consequences of failing to maintain rigorous standards are not theoretical—they are financial and systemic. Donarski points to the case of Gorge Drones, where the FAA proposed a $289,215 penalty for approximately fifteen agricultural spraying jobs.

The fine was not the result of a mid-air collision or a chemical disaster; it was the result of "compounding liability." Every takeoff without proper registration, every flight with an uncertified operator, and every mission without the required waivers acted as a separate violation. For a municipal agency, such a finding doesn’t just mean a fine—it triggers council hearings, budget clawbacks, and the permanent shuttering of the unit.

Implications: Building a Resilient Program

For small agencies with limited budgets, the advice is clear: Policy precedes hardware.

Operational Discipline

Donarski emphasizes that rigor does not require a large budget. Small agencies can achieve elite levels of compliance by adopting simple, consistent habits:

• Standardized Checklists: Physical, printed checklists used for every single flight.
• Battery Lifecycle Tracking: Utilizing paint pens to number batteries and logging charge cycles. This prevents the use of degraded power sources over active traffic or crowds.
• Data Hygiene: Treating ground control stations as "dirty devices." This includes disabling cloud backups, preventing connection to public networks, and using terminal scripts to hash data immediately upon ingestion.

The Transparency Dilemma

Agencies must find the balance between public accountability and operational security (OPSEC). Donarski proposes a "firewall zone" approach to public disclosure:

1. Routine Flights: Surveying city property or public works projects should be published on a public dashboard immediately. Transparency prevents rumors of "secret surveillance."
2. Tactical Operations: Overwatch, warrant execution, and barricaded subject missions must be shielded. Sensor logs and CAD entries for these events should remain locked in evidence until the case is adjudicated and statutory holds expire.
3. The "Coarse Itemized" Log: To satisfy transparency requirements without compromising safety, agencies should publish the flight date, a broad two-hour launch window, the call classification, and the general patrol district. Publishing precise coordinates or flight paths is a tactical liability that exposes staging points and surveillance techniques.

Conclusion: The Path Forward

The integration of drone technology into public safety is an evolution of law enforcement and municipal service, not merely a procurement of new toys. As Nick Donarski asserts, the difference between a successful program and a liability-ridden one lies in the transition from "operator" to "professional steward" of data.

Agencies that fail to implement cryptographic hashing for flight logs, ignore the risks of cloud-connected tablets, or skip the tedious documentation of battery cycles are setting themselves up for a fall. In the eyes of the law, a drone is a sophisticated sensor platform that generates evidentiary data. If that data cannot be proven to be accurate, untampered, and secure, the mission—and the department—will eventually face a reckoning in the courtroom.

For the small agency looking to start, the mandate is simple: Write your policies, harden your devices, and document everything. The hardware is cheap, but the cost of non-compliance is, in the eyes of federal regulators and the public, increasingly unaffordable.