Introduction
While uncrewed systems (US), more colloquially known as drones, have been known and used in various forms to perform multiple tasks for decades, they have become an increasingly visible issue in contemporary security studies due to significant changes and developments in this field. The first examples of weaponized drones represent various experiments from World War II and the Cold War. However, the threat of weaponized use of uncrewed systems has been changing in recent years and has serious implications for the security of critical infrastructure (CI).
There are several well-known factors;
- Proliferation of commercially available drones of various types.
- Possibility for these systems to be supported by artificial intelligence (AI). This warrants a fundamental question regarding possible threats to critical infrastructure, which is the key to the research question: How do current trends in the development of uncrewed systems, especially those related to artificial intelligence, influence possible scenarios of attacks on critical infrastructure systems and facilities?
Therefore, the first part of this article aims to describe the definition of critical infrastructure as well as uncrewed systems in general. These devices operate in several domains. Most of these are operating in the air domain - uncrewed aerial systems (UAS), which are helicopters, planes, and other flying machines. The other groups are maritime drones: surface and subsurface (underwater). Finally, the systems are employed in the land domain. All of them may also be divided by their assumed use: there are systems that were built for strictly military purposes and those that were designed for civilian markets and may be weaponized.
Critical infrastructure – definitions
Probably, the most intuitive definition of critical infrastructure (CI) would be strictly lexical, assuming that this is the part of infrastructure critical for accomplishing the mission of certain actors (persons or business entities). In a more formal approach, it is possible to compare some legal definitions to describe this sector better. The European Union legal system (Directive (EU) 2022/2557 of the European Parliament and of the Council on December 14, 2022, on the resilience of critical entities and repealing Council Directive 2008/114/EC) defines critical infrastructure as “an asset, a facility, equipment, a network or a system, or a part of an asset, a facility, equipment, a network or a system, which is necessary for the provision of an essential service”i. The mentioned “essential service” was defined as “service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment.” Worth mentioning is also the fact that this directive also defines “critical entities”, as “public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex.” Such entities belong to 11 categories (and multiple subcategories): energy, transport, banking, financial management infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and production, processing, and distribution of foodii.
The Polish Crisis Management Actiii provides similar definition, describing critical infrastructure as “systems and included, functionally connected elements, including buildings, installations, services essential to security of the state and its citizens as well as providing effective functioning of public administration, institutions and companies. Critical infrastructure includes the following systems:
- Providing energy, energetic raw materials and fuels;
- Telecommunication;
- Computer networks;
- Financial;
- Food delivery;
- Water delivery;
- Healthcare;
- Transportation;
- Rescue;
- Providing continuity of functioning of public administration;
- Manufacturing, transportation, storage, and usage of chemical and radioactive materials, including pipelines for dangerous materialsiv.
In the Polish legal system, such a broad definition marks only a framework for a more detailed process of the designation of systems as part of critical infrastructure. This is the responsibility of the Government Security Center, which uses unclassified and classified sets of criteria.
Finally, in the United States, the Critical Infrastructure Protection Act of 2001 defined critical infrastructure as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”v. An additional presidential directivevi designated 16 critical infrastructure sectors.
- Chemical;
- Commercial facilities;
- Communications;
- Critical manufacturing;
- Dams;
- Defence industrial base;
- Emergency services;
- Energy;
- Financial services;
- Food and agriculture;
- Government facilities;
- Healthcare and public health;
- Information technology;
- Nuclear reactors, materials and waste;
- Transportation systems;
- Water and wastewater.
It is clear that the American definition is wider than that used in Europe. For example, it includes critical manufacturing, such as metal production, machinery manufacturing, and transportation equipmentvii. In addition, as cited above, Polish and European Union definitions focus more on civilian or dual-use sectors of the economy, while in the US, the defense industrial base is considered a part of critical infrastructureviii. However, more important common elements are visible in all these definitions. Critical infrastructure is considered a fundamental element that allows the European Union, states, and societies to run their operations on a daily basis and provide critical resources. Another element is the interconnection between the elements and systems. For example, communication systems and computer networks require the generation and distribution of electrical power. Therefore, it is logical to consider the role of critical infrastructure not only in terms of facilities and systems but also from the perspective of continuity of services that are providedix. This also means that, in hybrid warfare scenarios, malicious actors may consider critical infrastructure as a crucial target, and the results may be much broader than those directly resulting from the attack.
Critical infrastructure - risk of physical attacks in the context of hybrid warfare
The aforementioned services may be disrupted in various ways, and the context of hybrid warfare is relevant. According to R. Seely, there are six broad categories composing the toolbox of Russian hybrid warfare: “governance (including religion, culture, and law), economics and energy, politics and political violence, military power, diplomacy and public outreach, and information and narrative warfare”x. Another author, M. Galeotti, describes various forms of hybrid warfare as the weaponization of different issues from crime to law. Another analyst, D. Kilcullen, proposes term “liminal warfare” to describe modus operandi of a state actor employing variety of tools from clandestine activities (the existence of certain operation is unknown), through covert, ambiguous and finally open actionsxi. This may include violent and nonviolent activities. All these hybrid warfare activities have been employed in various forms, including information and narrative campaigns, which include spreading disinformation to influence the targeted society. This may include campaigns directly aiming at critical infrastructure to slow down or cancel some projects in a similar manner to other propaganda campaigns from the past, such as anti-nuclear campaigns. However, these campaigns are slow and the results are difficult to measurexii.
There are other possible explanations for this. For example, large-scale Distributed Denial of Service attacks (DDoS) may be conducted against critical digital infrastructure, denying access to important services. This may lead to a significant disruption of societal functions and significant financial losses, as illustrated by the well-known case of the 2007 cyberattack in Estoniaxiii. However, DDoS usually does not damage the hardware and may be repulsed by the modification of software or network settings.
Physical attacks have several advantages from the perspective of attackers. First, they do have direct consequences because attacked facilities or systems are rendered unusable; therefore, critical services may be limited or not provided at all. This leads to another consequence: damage or destruction imposes additional costs on rebuilding lost capabilities. This means money, but can also be described in other ways. Some systems cannot be rebuilt or quickly restored. In short timeframe. The manufacturing and delivery of unique devices can take a long time. Therefore, time needs to be considered. In addition, professionals may be affected, forcing the operator to replace wounded or killed ones, although operating sophisticated facilities such as power grids, communications facilities, or data centers may require a uniquely qualified workforce. The replacement may be long and costly.
Finally, if critical infrastructure is successfully attacked, this will allow the attacker to create a narrative in which the targeted state is weak and unable to provide basic services. This can be used for further hybrid applications. This can be illustrated in a simple scenario. If a targeted country is dependent on imported energy resources such as oil or gas, an attack may disrupt existing import facilities such as pipelines or port terminals. In addition, physical attacks can be conducted in a disguised manner, suggesting that they are a result of domestic conflict. For example, attacks on the energy sector can be attributed to far-right groups. The report from 2023xiv highlights the ideological interest of the American far-right in attacking targets such as power grids or communications networks, especially 5G telecommunications networks, owing to widespread conspiracy theories related to this system. State actors can easily conduct a double-stage campaign. In the first stage, conspiracy theories or other ideological justifications are used to mobilize potential supporters. Then, these persons and groups are used to conduct actual attacks, complicating the internal situation of an attacked country. Then attacker may come with “stabilization” offer of providing necessary deliveries, potentially combined with some political or economic concessions, offering to deploy military forces as a “stabilisation” or “antiterrorist” force.
The drone threat - general perspective
Aerial drones have been used in military roles since World War II, and were employed during the Cold War. However, their roles are mostly limited to training support (aerial targets) or reconnaissance. The number of cases of armed drones was limited and mostly comprised experiments. For example, the US Navy tried to use a remote-piloted helicopter QH-50 armed with anti-submarine torpedoes as an alternative to piloted machines but reverted to using conventional helicopters because, due to technological limits, the attrition rate was higher than that of crewed machinesxv. This illustrates the challenges related to the use of drones. They require reliable autonomous or remote-control systems. While a simple reconnaissance mission may (at least in theory) be conducted using a preprogrammed route, its course should be corrected by some navigational systems (internal or external, especially radio navigational aids). During the Vietnam War, the widely used Ryan 147 drone (military designation: AQM-34) and its variants required modifications to conduct successful missions, including the ability to input manual course corrections during mid-flight. A more ambitious long-range D-21 supersonic strategic reconnaissance drone failedxvi. Despite these issues, during the Cold War, both sides had some form of reconnaissance drone. For example, the Soviet Union developed Tu-141 and Tu-143 Rejs systems.
The use of armed drones has resulted in additional problems. To strike particular targets, accuracy was required, especially if the target was small or moving. However, these early issues were gradually resolved. While in typical military applications, more efforts have been focused on the development of guided missiles of various kinds, and the results of technological progress have had effects on drones. The challenges are essentially the same: a missile or drone must be able to fly to a certain location and conduct a strike with acceptable accuracy. The main difference is the fact that conventional missile, even if using aerodynamic lift to fly – otherwise called “wings”– is designed as a one-way weapon, required to fly and strike target, while drones usually are designed to be recovered after missions. However, this distinction may be blurred because there are differences in design, modes of employment, and ad hoc modifications of existing systems, including one-way attack drones called “loitering munitions.” Special attention should be paid to the development of one-way attack systems. In addition, drones may be operated on purpose, assuming that they will be lost during certain missions. The most important aspect is the development of various precision navigational systems and guidance methods for the successful operational use of armed drones. The most notorious case was the use of armed MQ-1 Predator and MQ-9 Reaper aircraft in the Global War on Terror by the American military forces. While a detailed description of technological developments is beyond the scope of this study, it is possible to mention, among others:
- Progress in computer technology has allowed for digitalization and miniaturization of sensors, control systems, and communication devices.
- Development of small, inexpensive, and reliable digital cameras that took place in analog photographic or video cameras.
- The development of digital electronic intelligence and warfare sensors allows the gathering of information on various types of radio emissions.
- Development of reliable digital command and control systems, including capabilities of transfer of digital data, still images, and video feeds.
- Developments in computer processing power, allowing for progress in digital data processingxvii.
All of these factors have a significant influence on US capabilities and modes of employment. During the Cold War, imagery was gathered through analog photography. This would require the recovery of the drone with films, which would have to be developed and analyzed. Later, the drone could carry an analog video camera, which would allow information to be gathered in real time. As proven by the successful use of RQ-2 drones in Operation Desert Storm, when drones were used as spotters for naval gunfirexviii, the time between gathering information (e.g., detecting target) and taking action (e.g., engaging the target) would be reduced. Additionally, analog video systems have several limitations. At the end of these early developments, commercially available drones employed widely available components (including computer chips) and consumer-grade electronics. The same mechanism that led to the availability of digital cameras in smartphones or stand-alone devices such as GoPro led to the availability of digital camera-equipped drones such as the well-known and widely available DJI Phantom (in fact, the first model of this drone was equipped with a GoPro camera). This led to lowering the cost of drones, expanding their capabilities, and widespread civil use - in various applications, from pure recreational to highly professional, such as news gathering, movie production, and agricultural work.
Similar to other inventions (for example: cars allowed robbers for easier getaway and computers opened new spaces for malicious activities), the availability of drones led to their use in applications other than civilians. The use of weaponized drones in armed conflicts is well documented and discussed in the latter part of the article.
Drone threat - known and possible scenarios
The analysis of the trends described above in the development of uncrewed systems allows the description of actual and potential methods for the employment of drones. In 2016, the West Point report divided these methods into five categories: surveillance, external commands, smuggle/courier, disrupt, and weaponsxix. From the perspective of threats to critical infrastructure, it is possible to narrow this set to three groups: intelligence gathering, disruption, and kinetic attacks (destruction, damage, or disruption). Each of these groups provides a sketch of several scenarios. Here is a non-exhaustive set of scenarios that can, of course, be widened.
1. Intelligence gathering
The first and most common malicious use of drones is the gathering of intelligence that is useful to adversary actors. Depending on the nature of the requirements and context in which intelligence is gathered, this wide category may be divided into several narrower scenarios.
Scenario 1.1 Covert intelligence gathering
In this scenario, an adversary actor aims to gather information that allows for further decisions and actions, including attacks. Therefore, this information should be collected without alerting potential targets. The uncrewed systems offer particular advantages, especially allowing for the remote collection of intelligence, thus minimizing the risk of exposure of persons who may stay away from the target. Drones can be employed to gather the intelligence of a particular facility in order to gather information about buildings, installations, and entrances. This basic intelligence may be acquired during a quick overflight. Another method may be persistent surveillance if the drone is able to stay in the area of interest for several hours. This may allow noticing the movements of persons and vehicles in and around the facility and detect constant patterns (e.g., time when employees arrive and leave the facility, schedule of deliveries, or service works such as maintenance). Additionally, information on security systems and the behavior of security personnel may be collected in this manner. For example, drone surveillance may reveal that guards follow certain patrol patterns, making their actions predictable. Another option is to use drones to follow moving targets to gather intelligence regarding the movements of people and vehicles. This type of persistent surveillance was employed by US military forces during counterinsurgency and counterterrorist operations in Iraq. That “unblinking eye” allowed to create “patterns of life” of persons of interest, gather information on places and areas of interestxx. While the US forces targeted terrorists and insurgents, owing to developments in technology, adversary actors may gather intelligence on possible targets in a similar manner, thus supporting their planning process. In addition, this method of using drones may include various modes of data-gathering. Commercially available drones, purchased off the shelf without any modifications, can provide daylight photos and video imagery. However, depending on the available resources, other sensors can be used. Drones may carry (or place) low-light, infrared, and thermal cameras, allowing for gathering imagery at night. Other possibilities include the use of acoustic sensors or electronic intelligence devices to intercept radio transmissions, which include GSM signals (cell phones) and Wi-Fi networks, as well as other devices. Aerial platforms, owing to their ability to overflight natural and artificial obstacles (e.g., fences), may offer particular use in that scenario. In addition, maritime and land platforms may be employed in a similar manner; for example, uncrewed submarine vessels may sneak into a port or gather intelligence on offshore platforms. Since this scenario assumes covert intelligence gathering, the exact number of such incidents is not known. This case is known only if a drone has been spotted. One of online accessible databases – “Drone Attack & Incident Tracker” – of such incidents contains information about eleven casesxxi.
Scenario 1.2 Overt intelligence gathering
This scenario assumes that drones are employed voluntarily to trigger and gauge responses. This response may include the activation of emergency communication networks, crisis management plans, and deployment of additional security forces or systems. This may lead to gathering valuable intelligence, especially regarding communication systems that are used in emergency situations. It may allow the reconstruction of a chain of command and communication, measurement of response time, and detection of systems that are deployed to counter the drone. It was suggested that some of the mysterious sightings of flying objects in the US airspace were the result of such activities, aimed at gathering data on the US Army air defense systemsxxii.
Scenario 1.3 Reconnaissance during kinetic attack and post-strike assessment
This scenario assumes that a drone is deployed as an asset to support other actions. This may include attacks conducted by persons, such as raids on a particular objective (facility), who may utilize intelligence-like live videos gathered by an uncrewed system to avoid detection by patrolling security personnel. In addition, after an attack, drones may be employed to conduct damage assessment, providing fast information about the results of the attack and the necessity of repetition of the attack against a particular target. Gathered footage can also be used for strategic communication (e.g., showing successful attacks in an attractive manner).
2. Disruption
This group of scenarios comprises two main proposals, assuming that drones are used not to destroy the target but to disrupt the operation of a given facility.
Scenario 2.1 Disruptive drone behaviour
This scenario assumes that drones are employed in a manner that has a direct effect on the attacked facility, system, or service by disrupting regular operations. This may result in the implementation of contingency, crisis response plans, or the activation of additional security assets. These actions interrupt operations, leading to suspension of critical services. One example is drones that penetrate the controlled airspace of major airports. The presence of an unauthorized aerial vehicle in such a space will result in major changes in the departures and arrivals of planes using this airport for security reasons. This scenario occurred in December 2018 at Gatwick airport when, twice in one week, unauthorized drone incursion resulted in hundreds of flights being delayed affecting 120 000 passengers, due to the inability to conduct normal operationsxxiii. It is easy to notice that in this type of activity, passenger flights may be affected. Drones may be employed aggressively (a phenomenon called “buzzing”) over heliports dedicated to emergency services (such as medical emergencies, police, or fire services), forcing helicopters to abort starting or landing attempts in fear of collision with a drone. This form of harassment is not limited to airspaces. Unauthorized operation of uncrewed maritime vehicles, operated in an unsafe manner, may disrupt traffic on shipping lines, especially in the proximity of ports (anchorages, roads, inland waterways), where it may be difficult to avoid dangerous areas. In addition, repeated cases of drone incursion may place additional strain on personnel, increasing work-related stress, and may lead to serious fatigue, resulting in a slowing response or threat neglect. The second option is particularly dangerous. If there are recurrent cases of drone activity, but limited only to “buzzing” or other form of disruption, but not resulting in more dangerous situations, personnel employed at the attacked facility may begin to consider this activity as irritating but benign, originating from merely irresponsible persons. This may lead to neglect of security procedures. This may, in turn, hamper detection and response to more advanced threats.
Scenario 2.2 Jamming
This scenario assumes that uncrewed systems are platforms for electronic warfare. Such systems may be employed to disrupt or deny radio communication or other radio-frequency emissions, such as navigation systems. This type of activity may make certain critical systems difficult or impossible to use. One possibility is the use of jamming satellite navigation systems (such as GPS or Galileo) or cellular networks (GSM). In addition, some systems such as transportation systems are particularly vulnerable to jamming. Planes, trains, and ships require reliable communication for safe operations. Another possibility is to use drone-borne jamming devices to send specific systems such as alert messages, causing the cessation of certain activities. For example, in Poland, the railway radio communication system has a built-in feature that allows sending an alert signal to remotely stop trains within the range of the signal. The malicious use of this system has caused significant delays. Drones may allow the placement of a jammer at a certain location or height, providing the optimal conditions for propagating jamming signals.
3. Kinetic attacks (destruction)
This employment of uncrewed systems can lead to several scenarios in which drones are employed to destroy targeted systems or facilities. Drones can only be used as weapons or in combination with other tools.
Scenario 3.1 Drone as weapon carrier
This scenario assumes that an unmanned system is a platform for weapons, potentially employed against the critical infrastructure systems, facilities, and persons employed at these facilities. Because a drone is used only as a carrier, its mission is to deliver the ordnance and recover it for future use. This makes this option particularly useful for repeated attacks or when the value of the drone (including its carrying capabilities) is much higher than the weapons carried. These can be divided into at least three subcategories. In the first, a drone carries weapons that are launched or dropped on target-like guided or unguided bombs or missiles. Maritime applications may involve launching the torpedoes. It is also possible to employ ground-uncrewed vehicles as missile or missile launching platforms. The armament may even include smaller dronesxxiv. This category of armament allows for conducting “standoff” attacks, and weapons carriers remain at a relative distance from the target, optimally beyond the range of defence systems. On the other hand, drones may carry armaments fixed to the vehicle, such as a machine gun or a grenade launcher. This may require getting close to the target in a manner similar to that when crewed vehicles are employed. In addition, drones may be used to carry mines or explosive devices that are placed in a covert manner and are activated at a later stage. Finally, drones can carry other devices designed to cause damage. This is the case with the already mentioned drones equipped with a copper wire to damage the electrical substation. There are a wide variety of such options, including the adoption of commercially available off-the-shelf drones as carriers of improvised explosive devices. This tactic was widely employed by Islamic State forcesxxv and is used in other armed conflicts. They may use fully improvised devices, as well as depending on the available resources and scale of operations–standardization of purchased drones, equipment, and explosive devices–again, adapted (like hand grenades or other munitions), or purpose-built. The use of off-the-shelf drones has significant advantages, particularly low cost and high availability (including online sales). It is also possible to use “front” actors (persons or companies) to acquire them, thus maintaining an operational covert. One of the disadvantages is the limited choice of devices, the fact that they were built for peaceful purposes, or their range, endurance, or limited carrying capability. For example, the widely popular DJI Phantom Pro 4 can carry 800 g of payload under ideal conditions, and a bigger one, DJI Matrice, can carry up to 6 kgxxvi. More advanced and expensive devices, such as agricultural drones, may carry several dozens of kilograms of payload, such as DJI Argas T40, which can carry up to 50 kgxxvii. A more advanced method employs devices built for kinetic operation. A classic case is a military drone, for example, the already mentioned and well-known American MQ-1 Predator and MQ-9 Reaper, which can carry laser-guided missiles such as AGM-114 Hellfire and laser-guided bombs. There are other possibilities, depending on the capabilities available to the actor conducting the attack, and the availability of certain types of weapons and ammunition may be critical factors. For example, there are known cases of drones attached with firearms, made by amateurs and seemingly just an experimentxxviii, but there are also more professional solutions. Polish-made Perun ground uncrewed vehicles may be armed with machine guns in their dedicated weapon station (turret) or with guided anti-tank missilesxxix. Therefore, the only limits are strictly technical factors (especially drone parameters) and the availability of weapons.
Scenario 3.2 One way attack drones
This type of system is often referred to as “kamikaze drones” because they are built and employed in a manner that assumes that a drone is destroyed during an attack. Known examples in the aerial domain are systems described as “loitering munition”, such as Polish Warmatexxx or Israeli Haropxxxi. In addition, FPV drones (First Person View), well-known from the Russia-Ukraine War, fall in this category; however, they are much more ad hoc constructed systems, for example, using warheads from locally available weapons. Another form of one-way weapons is systems used by Russia, including Iranian-designed Shahed 136 drones. There is also a documented attempt to convert large airplane models to one-way attack drones. It is also possible to convert conventional manned aircraft to uncrewed aircraft by exploiting their capabilities (range and payload) and availability (especially general aviation planes used for sports, recreational, and other purposes).
Ukrainian forces employ other solutions in the maritime domain in the form of uncrewed surface vehiclesxxxii. One-way attack drones can also be manufactured in the ground domain and designed to strike certain targets. One of the earliest examples is “Goliath” self-propelled, remote-controlled demolition device employed during World War II by the German Army. It is easy to assume that every ground vehicle that can be remotely controlled can be adapted to this role.
Elements that distinguish between one-way drones and other types of drones are:
- The ability to remain active through a relatively extended period of time in search of a target compared to other types of weapons used against a given category of targets.
- Ability to search for targets during a mission or change the target during the engagement phase.
- Possibility of recovery and reuse in the case of failure to successfully engage the target.
These elements provide a basic, albeit still blurred, distinction between comparable weapons. For example, a typical torpedo is uncrewed and launched against a detected, identified, and tracked target. However, even if the weapon is equipped with a self-guidance mechanism, it is usually employed against surface ships or submarines whose presence is suspected. A maritime one-way drone can be used to patrol the designated area and conduct additional identification. Similarly, some anti-tank missiles, guided by an internal camera and datalink, may be used for short-term target identification. The target may change during flight; however, this phase is usually short, limited to several minutes, while one-way drones may remain in the air for a longer time. These abilities allow for various modes of drone employment against various targets and have significant advantages over weapon-carrying drones or crewed vehicles. Because the device is purposely destroyed during an attack, there is no need to include the way back after the attack in the device’s conceptualization. From a technical perspective, it may allow the full capacity to reach the target, greatly expanding the range of the device. From an operational perspective, the device does not need to make its way back over enemy-controlled territory, and there is no need to maintain resources for recovery. Compared to crewed systems, a significant advantage is the lack of necessity for personnel recovery or navigational aids.
The actual threat: review of selected case studies of drone use
The 2016 reportxxxiii describes 15 cases of terrorist organizations, groups, and individual persons engaged in various forms or attempts to use drones. However, not all of these included actual uncrewed system use. Some were limited to the possession of systems and not using them or conducting experiments. Others have attempted to strike targets that can be identified as part of the critical infrastructure. Notable cases of actual drone use in intelligence gathering as well as in a weaponised form were by the Islamic state in Syria and Iraq (ISIS). This organization employed commercial drones such as the DJI Phantom quadrocopter. In a weaponized form, these devices were equipped with a crude but effective carrying and release mechanism for loads, such as grenadesxxxiv. Earlier attempts include Rewzan Fedarus’ 2011 plot to attack the pentagon – maybe one of the earliest attempts, while the feasibility of planning (using just off-the-shelf flying models) could be questionedxxxv. It is notable that the person decided to conduct an attack in such an unusual manner at this time.
Other organizations, such as Hezbollah and Hamas, became more advanced and more successful in using drones. This is not surprising, considering their resources and the level of political ambitions. This group of actors was later joined by the Houti Movement in Yemen. Due to Iranian support, this group managed to build significant capabilities before the present (2023–2024) Red Sea crisis. The first sign of these capabilities was the use of Qasef-1 drones, capable of delivering a 30–45 kg explosive warhead with a range of up to 150 km. Later, the group used different drones from the Sambaed family, which had an estimated range of up to 1500 kilometresxxxvi. These capabilities allowed Houtis to conduct attacks on the Saudi gas facilities in 2019xxxvii. Further cases illustrate their ability to attempt strikes on more distant targets, including Israel.
Other well-known cases are related to the large-scale Russian invasion of Ukraine. A campaign against Ukrainian critical infrastructure, especially the power grid, is widely conducted with a shared family of one-way drones, resulting in significant damage to the Ukrainian power system. In addition, Ukrainian forces have been engaged in strike operations against Russian targets, including military bases, the defence industry, and petroleum facilities. Ukrainian forces have used various types of devices, including converted Soviet era Tu-141 jet – powered reconnaissance, locally propelled UJ-22 Airborne and Bober planes, and commercially available Skyeye 4450 (made in China)xxxviii. In addition, there are known cases of conversion of piloted planes to uncrewed attack drones.xxxix
The use of drones against critical infrastructure is not only related to lone actors or war zones. For example, in 2019, a drone was found near an electrical substation in Pennsylvania, and the drone, a DJI Mavic, was modified with copper wire to disrupt the facilityxl. Another known case was the sighting of drones of unknown origin flying over and around the Palo Verde Nuclear Generating Station in the United Statesxli. In 2022, suspicious drone activity was reported near the Norwegian Roar Gas Field in the North Seaxlii. Similar incidents have occurred in Norwayxliii and Swedenxliv. However, there were no direct attacks, and all those incidents raised suspicion of intelligence-gathering activities, with obvious questions about Russian involvement. Since it is clear that there are wide technical possibilities to use drones, and there are known cases of attacks, an important variable to investigate is the influence of technological developments, such as artificial intelligence.
Influence of artificial intelligence on the drone threat
Norine MacDonald and George Howell’s 2019 article “Killing Me Softly: Competition in Artificial Intelligence and Unmanned Aerial Vehicles”xlv identified several fields of technological progress of Artificial Intelligence related to aerial uncrewed systems:
- Air combat algorithms: a set of capabilities allowing for the successful use of drones in air-to-air combatxlvi.
- Machine vision: labeling (interpretation) of data received from visual sensors (cameras).
- Manned–unmanned teaming – a combination of crewed and uncrewed elements in one combat system.
- Automated missions – the ability to conduct independent mission planning using preapproved parameters (e.g., target selection).
- Swarming – the ability to use multiple drones in a cooperative manner.
- Autonomous flight – the ability to navigate independently from external support systems such as ground commands or GPS systems.
- Counter UAV systems – the use of AI in systems countering enemy drones.
- AI and electronic warfare: the employment of artificial intelligence applied to electronic warfare, such as jamming.
Remarkably, these fields exhibit mutual interactions. For example, machine vision may be crucial for autonomous flight, a capability that is natural for the human mind – recognition of shapes, colors, patterns using eyes that allow for simple navigation (such as following a trail or road) and recognition of people and objects is difficult for drones, who often rely on external support (such as GPS). This improvement may also allow autonomous missions to be conducted, allowing the drone to recognize a specific target according to a given set of parameters using cameras instead of other sensors. It is helpful to conduct an assessment of these fields in the context of the mentioned scenarios of attacks with a view to threats to critical infrastructure. In the case of intelligence gathering, mission parameters are always limited by pre-existing information requirements. However, certain developments may also be helpful. In particular, machine vision can significantly increase the quantity and quality of information. For example, a drone may be tasked with conducting surveillance at a certain facility to identify patrols and other security elements. This is possible by the overflight of a device or, if possible, a longer presence in proximity to the target, but the identification of security personnel among various persons who are working in a certain facility would require human action by simply watching gathered footage. This is time consuming and requires qualified personnel. In the case of artificial intelligence, software may be used to search for certain features (such as security guards’ uniforms or vehicles) or programmed to identity distinctive behavior (e.g., presence of people near the fence). Similarly, the software can potentially be used to identify certain vehicles or even people using face recognition capacities. This allows for more effective use of surveillance drones. For example, during a surveillance mission, a drone finds a certain person or vehicle and the mission parameters may allow the drone to follow this object without human interference. In addition, swarming may be useful for gathering intelligence. Because the critical infrastructure may be composed of large systems, such as data centers, communication lines, railroads, pipelines, or power lines, large-scale efforts may be required to gather information on them. Having several drones operating in a coordinated manner may make such an effort easier. The same principles apply if drones are used for attack. Artificial intelligence can be used to recognize targetable objects and persons to conduct strikes to improve their efficiency. Instead of simply directing the drone to attack certain buildings, the device can be programmed to search for defined features and strikes at the most vulnerable places. In addition, it may avoid some basic anti-drone defence measures. For example, having autonomous attack drones may circumvent the jamming of control and communication networks because, in that case, the drone does not have to be remotely controlled but conducts a mission according to preprogrammed parameters.
Finally, if autonomous systems become increasingly widespread, malicious actors can exploit this opportunity. Although autonomous cars are still in limited and experimental use, they may be used in the future, for example, as delivery vehicles or taxis. This may mean that future attackers, instead of simply conducting blind attacks by ramming trucks into people or leaving vehicle-borne explosive devices near targets, may use more sophisticated weapons. An autonomous car may carry an explosive device and be ordered to find a certain car or deliver the bomb to a certain building. However, this may have dangerous consequences. This can be illustrated by using several scenarios.
Scenario 1. Targeted attack on power grid
Potential targeted systems include power grids composed of power stations, substations, and overhead power lines. To prepare for the attack, drones may be programmed to conduct surveillance flights along the power lines, and autonomously gather data on all persons and vehicles that were present near them. Special attention may be paid to maintenance workers and vehicles operated by them, which are usually distinctive owing to their shape, size (including maintenance equipment carried on them), and distinctive markings.
After the identification of those persons and vehicles, a series of strikes against power lines could occur. Because maintenance personnel are always dispatched to repair damaged lines, drones are programmed to patrol previously attacked areas and strike detected maintenance crews (called “double-tap” tactics). This may force the power grid operator to slow down or even cease any repair work owing to danger to the workforce. This may lead to serious social, economic, and political consequences, since the inability to restore power delivery to the population may be exploited by hostile state actors, creating narratives stating that local authorities cannot resolve the crisis.
Scenario 2. Targeted harassment of airport
In this scenario, the target is an airport in state A, served by multiple airlines, including several airlines from country B. The attackers, supported by a state actor, try to block access to the airport for carriers from one particular country to create problems between states A and B.
Since escalation of the attack to possibly lethal consequences is not desired, the chosen modus operandi is the disruption of operations on the targeted airport. Drones are activated whenever sensors monitor the airspace, and radio traffic detects the airplanes from B country airlines approaching. If such a plane is detected, a drone is launched and starts a series of overflights near and inside the airport airspace, forcing the suspension of operations. When systems detect that, as a consequence, an approaching plane is forced to divert to an alternative airport, drone activity ceases. Because this system is automated, it is possible to deploy several of them in hidden locations around the airfield, making response difficult.
Scenario 3. Manned unmanned teaming scenario
This scenario assumes that a group of saboteurs sponsored by a state actor is going to conduct an attack on a critical infrastructure facility – in this scenario, a power plant – to destroy key control systems and kill crucial personnel. Before and during the infiltration, a group deploys autonomous aerial and ground vehicles to gather tactical intelligence to avoid security patrols and then conducts a diversionary strike against a security patrol in a remote area of installation. After the attack has been launched, the group withdraws, and additional police forces are called to the facility. Autonomous drones were deployed to stop or slow down the response. Devices, using machine vision and pattern recognition, target only police vehicles and jam police frequencies using electronic warfare employing tactics similar to above mentioned “double tap” tactics.
These scenarios illustrate a set of challenges for the protection of critical infrastructure and steering possible technological developments. The use of malicious drones may be more effective than the previous methods. For example, in the last scenario, drones were used to cover the withdrawal of the attackers. Traditional slowdown methods against response forces include placing down spikes or other obstacles, using mines, or preparing ambushes. These methods are time-consuming and risky (as people are to be present in a given area), and they may be prematurely discovered. Therefore, precise drone attacks may be more effective. A similar case is observed in the first scenario. If there was just a conventional threat to repair personnel, such as explosive devices placed near damaged lines, those threats could be identified and then disposed by trained police personnel. The use of drones offers more flexibility and puts heavy strain because there are significant challenges related to the prevention and response to uncrewed systems.
Recommendations
Several important recommendations appear regarding critical infrastructure protection in the context of technological developments in uncrewed systems:
1. The development of uncrewed systems is ongoing and unlikely to be stopped. While there may be, in the future, attempts to regulate the use of artificial intelligence and there are already some rules regarding drones (especially in the airspace), hostile actors are likely to disregard them. Because of the presence of uncrewed systems in the air, land, and maritime domains and a wide set of technological possibilities, from ad-hoc adapted commercially available solutions to advanced systems developed by nation states, no scenario may be excluded.
2. In preparing any preventive solutions and countering drone threats, it is rational to assume that those solutions should not be prepared only for present-day threats, but also predict future ones to develop preventive and countering measures.
3. It is necessary to assume that at least some elements of the trends described above are easily available, even in the civilian market. Counter-drone systems must be designed and used with this assumption. For example, it may be necessary to have available solutions for intercepting or destroying drones that do not require external navigation systems. It may include drones that are capable of intercepting and destroying hostile drones.
4. It is also possible that developments of artificial intelligence will enhance the capabilities of security and defense systems. The detection of drones may be particularly supported by machine vision and other algorithms. In addition, swarming may be useful as a protection tool through the coordinated deployment of numerous devices as part of the security system.
In conclusion, there is a visible evolution trend in the field of uncrewed systems. In the past, they were mostly used for intelligence gathering, and armed drones were mainly used on an experimental basis. In the first years of the present century, armed drones became just another type of weapon used by leading military powers as well as non-state actors. The merging of drones and artificial intelligence is the next step in this evolution. Therefore, it is essential to closely monitor this trend. As the above scenarios show, AI-augmented drones may pose a greater risk to critical infrastructure. It is extremely important and urgent to protect this infrastructure by developing solutions that can mitigate the risks posed by the new generation of uncrewed systems.
Ethics and consent
Ethical approval and consent were not required.
Data availability
No data associated with this article.
Data is not relevant to the research method, therefore no data are associated with it
Faculty Opinions recommendedReferences
- Bloom JD:
Unmanned aerial systems: a historical perspective. Occasional Paper 37. Combat Studies Institute Press US Army Combined Arms Centre Ft Leavenworth. 2010. Reference Source
- Clarke C, Sakrsjig M, Millender M, et al.:
The targeting of infrastructure by America’s violent far-right. Reference Source
- Directive (EU) 2022/2557 of the European parliament and of the council of 14 december 2022 on the resilience of critical entities and repealing council directive 2008/114/EC. Reference Source
- Evolution of UAVs employed by houthi forces in Yemen. Reference Source
- MacDonald N, Howell G:
Killing me softly: competition in Artificial Intelligence and Unmanned Aerial Vehicles.
PRISM.
2019; 8(3). Reference Source
- Piekarski M, Wojtasik K:
Protection of polish Critical Infrastructure (CI) against air threats.
Security and Defence Quarterly.
2022; 39(3): 76–87. Publisher Full Text
- Presidential policy directive /ppd-21 critical infrastructure and resilience. .
http
- Pursiainen C, Kytömaa E:
From European critical infrastructure protection to the resilience of European critical entities: what does it mean?
Sustain Resilient Infrastruct.
2023; 8(sup1): 85–101. Publisher Full Text
- Raster D:
Keep it simple, stupid! the Islamic State’s tactical and operational drone innovations. Combatting Terrorism Center at West Point, 2018.
- Rassler D:
Remotely piloted innovation. Terrorism, drones and supportive technology. Combating Terrorism Center, West Point, 2016. Reference Source
- Seely R:
Defining contemporary Russian warfare: beyond the hybrid headline.
The RUSI Journal.
2017; 162(1): 50–59. Publisher Full Text
- Ustawa z dnia 26 kwietnia 2007 r. o zarządzaniu kryzysowym (Act of Parliament of 26th April 2007 on Crisis Management). Reference Source
