On the evening of September 29, 2025, employees at Equinor’s Sleipner gas field complex in the North Sea detected an unidentified drone flying over the platform. Norwegian police launched an investigation and began analyzing intelligence data to determine the drone’s type and origin. No determination was made public. No operator was identified. No countermeasure was taken against the drone while it was present (Kyiv Independent, 2025). The Sleipner incident was not exceptional. It was the latest in a pattern that Norwegian authorities had been documenting since 2022, when unauthorized drones were reported at more than ten oil and gas facilities across the Norwegian Continental Shelf, prompting the Norwegian Petroleum Safety Authority to issue formal warnings to all facility and vessel operators in the region (Offshore Magazine, 2022). Equinor, TotalEnergies, and ConocoPhillips had each reported drone sightings near their North Sea platforms with unknown origins, incidents that the Norwegian government responded to by deploying Navy vessels to offshore installations and increasing police presence at onshore facilities (Scandasia, 2022; Robin Radar, 2025). By April 2026, UK industry body Offshore Energies UK had confirmed to The Scotsman that drone sightings near offshore energy structures were occurring regularly enough to warrant a dedicated reporting process and a coordinated exercise to test the sector’s security resilience (The Scotsman, 2026). The threat is documented. The capability to respond to it is not. Offshore energy infrastructure such as oil and gas platforms, subsea pipeline networks, and the more than 100 offshore wind farms now operating in the North Sea, occupies a structural gap in the counter-drone architecture that protects onshore critical infrastructure: it is too far from shore for police response, too regulated for unilateral private action, and too strategically significant to leave exposed. The FY2026 NDAA’s SAFER SKIES Act, signed into law on December 18, 2025, has begun to close that gap for onshore critical infrastructure operators, but its implementing regulations are not due until mid-2026, the FBI’s National Counter UAS Training Center is projected to certify only approximately 60 SLTT officers by June 2026 against demand from 18,500 law enforcement agencies, and the drones are not waiting for the rulemaking calendar (Lawfare Media, 2026).
The offshore energy infrastructure of the North Sea and Norwegian Continental Shelf represents one of the highest-value concentrations of critical infrastructure in the world, and one whose geographic characteristics create security challenges that have no straightforward analogy in the onshore environment. Norway became Europe’s largest natural gas supplier following Russia’s invasion of Ukraine and the subsequent decoupling of European energy markets from Russian imports, a strategic position that makes its offshore gas platforms and the subsea pipeline network connecting them to European consumers a target of obvious significance for any actor wishing to pressure European energy security (PBS NewsHour, 2022). Equinor’s Sleipner complex alone processes natural gas from multiple fields and feeds directly into the European pipeline network. A successful kinetic attack on a single major platform would not merely damage the facility. It would affect the energy supply of millions of European households and generate the kind of market shock that state actors have demonstrated willingness to engineer through less direct means.
The wind farm dimension adds a second category of strategic infrastructure whose security challenge differs in important ways from conventional offshore oil and gas. As of early 2026, more than 100 offshore wind farms were operating in the North Sea across the exclusive economic zones of Germany, the United Kingdom, the Netherlands, Denmark, and Belgium, with the Hamburg Declaration signed in January 2026 by nine North Sea states committing governments to ramping up offshore wind capacity to 15 gigawatts annually from 2031, a program expected to generate approximately €1 trillion in economic activity and supply 10.5 million average European households (Euronews, 2026). This scale of infrastructure commitment represents an exponentially expanding attack surface in waters where drone surveillance activity has already been documented at existing facilities. The security challenge of protecting 100-plus wind farms spread across five nations’ exclusive economic zones, each with its own legal framework, its own law enforcement jurisdiction, and its own threshold for what constitutes an actionable drone threat, is structurally different from the challenge of protecting a single high-value platform. There is no single point of failure. There is also no single responsible authority.
The question of who is responsible for counter-drone response when a drone appears over an offshore energy installation is considerably less clear than it appears from shore. In Germany, if a drone is spotted near critical infrastructure onshore, the police are the responsible authority. If it is flying over a military site, the armed forces are authorized to take defensive action. But when a drone is spotted over an offshore energy installation, potentially surveilling the platform’s layout, equipment configuration, or personnel movements, it is frequently neither registered nor reported through any systematic channel, and the chain of authority for response is genuinely ambiguous (Euronews, 2026). RUSI research fellow Dan Marks articulated the structural problem at a roundtable convened by RUSI and the European Initiative for Energy Security in April 2026: “There have been reports from industry associations and companies of nuisance things, unexplained drones, where we don’t know where they’ve come from, they’re flying around, causing disruption, and ships loitering. We’re not actually at the point where we’re really having that discussion” about who is responsible for monitoring, escalating, and acting on offshore drone incidents (The Scotsman, 2026, para. 4). The roundtable was attended by Ministry of Defense and Energy Department officials alongside energy company executives and security providers. The fact that senior officials and industry leaders were gathered to have this foundational governance discussion in April 2026 is itself a measure of how far the institutional framework lags behind the operational threat.
The Norwegian Petroleum Safety Authority’s framework provides the clearest existing example of regulatory engagement with the offshore drone threat, and its limitations illustrate the structural gap precisely. The PSA’s formal warnings require facility and vessel operators to report drone observationse and establish that all platforms on the Norwegian Continental Shelf are surrounded by a 500-metre safety zone extending from the seabed to 500 meters above the highest point on the facility (Offshore Magazine, 2022). Entering that zone without authorisation is illegal. The drone that entered Equinor’s Sleipner safety zone on September 29, 2025 committed an illegal act under Norwegian law. Norwegian police investigated. No operator was identified or prosecuted. The drone had already departed the area before any response capability was in position to address it. The legal framework prohibits the incursion. The operational capability to detect, attribute, and respond to the incursion before it completes its purpose does not exist at the platform level, and shore-based response infrastructure cannot reach a platform hundreds of nautical miles offshore within the time window that matters.
The private security gap compounds the jurisdictional ambiguity. Offshore energy facility operators have invested substantially in detection infrastructure such as radar, electro-optical sensors, and radio frequency monitoring capable of identifying and tracking unauthorized drone activity in the airspace above and around their platforms. What they do not have is the legal authority to take any action regarding a detected drone beyond reporting it to the relevant authorities and waiting. As Robin Radar’s February 2025 analysis of counter-UAS radar for offshore oil rigs documented, the offshore environment’s detection challenge is technically addressable: counter-UAS radar is “small, lightweight, and straightforward to deploy” in offshore environments, providing full situational awareness and accurate tracking across a platform’s airspace (Robin Radar, 2025). The constraint is not detection. It is a response authority. A private facility operator who jams a drone’s communications signal, intercepts its flight path, or takes any other active countermeasure is acting outside their legal authority in every jurisdiction in which offshore energy platforms currently operate. It is also subject to aviation law violations, spectrum interference regulations, and in some cases criminal liability for interfering with an aircraft, regardless of the purpose for which the aircraft was deployed.
The SAFER SKIES Act, embedded in Title LXXXVI of the FY2026 NDAA signed by President Trump on December 18, 2025, represents the most significant expansion of counter-drone authority in U.S. domestic law since the original federal C-UAS authorities were established (HSToday, 2026; AirSight, 2026). The Act expands DHS and DOJ authority to conduct detection, tracking, and mitigation of unmanned aircraft posing credible threats to covered facilities and events, and extends a version of that authority to state, local, tribal, and territorial law enforcement and correctional agencies operating under federal training, certification, and equipment approval requirements (DroneLife, 2025; AeroDefense, 2026). The significance for critical infrastructure protection is the directional change the Act represents. For the first time, U.S. law acknowledges that counter-drone response cannot be exclusively concentrated in a narrow club of federal agencies, and that the infrastructure requiring protection is too distributed and too operationally varied for a centralized federal response to be the primary protective mechanism (HSToday, 2026).
The Act’s specific limitations are equally important for offshore energy operators to understand. As AeroDefense’s April 2026 analysis of the SAFER SKIES framework documented with specificity, the Act does not grant mitigation authority to private critical infrastructure owners, does not allow action without training and certification, does not remove FAA, DOJ, or DHS oversight, and does not legalize unauthorized jamming or interception (AeroDefense, 2026). Critical infrastructure continues to be protected by trained law enforcement and correctional agencies, not by facility owners independently. The Lawfare Media analysis of the counter-UAS certification bottleneck created by this framework documented the operational consequence with precision: the FBI’s National Counter UAS Training Center — “the sole certifying authority” under the Act — is projected to certify only approximately 60 state, local, tribal, and territorial officers by June 2026, against demand from more than 18,500 law enforcement agencies nationwide (Lawfare Media, 2026). The threats that require response “emerge quickly and resolve in minutes” — and a certification pipeline that produces 60 qualified personnel nationally against demand from 18,500 agencies is not a response infrastructure. It is a planning framework whose operational expression is still years away from meeting the scale of need the Act identifies.
DHS and DOJ have 180 days from the December 18 signing to publish implementing regulations establishing training standards, the authorized equipment list, and compliance oversight procedures, a deadline that falls in June 2026 (AirSight, 2026). Until those regulations are published, SLTT agencies cannot independently deploy the new authority the Act creates, instead participating through FBI task force deputization that allows them to operate under federal authority during specific operations (DroneLife, 2026b). The framework for integrating that authority into offshore energy protection has not yet been designed.
The attribution ambiguity that characterizes documented drone incidents over offshore energy infrastructure is not a temporary information gap waiting to be closed by better intelligence collection. It is the deliberate operational posture of sophisticated state and non-state actors who have learned that unattributed drone surveillance of critical infrastructure generates intelligence value without triggering the response threshold that an attributed state actor would cross. The Kyiv Independent’s reporting on the Sleipner incident noted that increased drone surveillance of Norwegian offshore platforms had been “a concern since 2022, when Norwegian authorities deployed sensors near offshore platforms following a surge in drone activity”, and that subsequent incidents occurred despite that surveillance deployment, suggesting that the actors responsible were aware of the monitoring and confident in their ability to conduct operations within its limitations (Kyiv Independent, 2025). Norwegian military experts had assessed the 2022 drone surge as consistent with Russian intelligence collection following Norway’s emergence as Europe’s primary natural gas supplier, but no confirmation was made public, and no state attribution was formally announced.
Euronews’ May 2026 analysis of European offshore wind farm security documented the deliberate ambiguity that governs the threat environment. Defense against hybrid threats “remains fragmented, largely because many countries rely on different systems and structures,” and the private sector faces a specific challenge in that it “needs to know who is responsible for what at every stage: before an attack, during an attack and throughout the recovery process” — a clarity that no existing framework for offshore energy infrastructure currently provides (Euronews, 2026, para. 4). The consequence is not merely that individual drone incidents go unaddressed. It is the pattern of unaddressed incidents that normalizes surveillance of offshore infrastructure, establishes the precise contours of detection and response capability, and creates an intelligence picture that a more consequential operation would exploit. A drone that surveys Equinor’s Sleipner platform without triggering a response has provided its operator with information about the platform’s layout, personnel patterns, security equipment positioning, and response time that has tactical value independent of whatever the drone itself was doing.
The Lawfare Media analysis identified the specific operational consequence that this attribution-and-response gap creates for critical infrastructure: “Unauthorized drone incursions present risks ranging from surveillance and operational disruption to interference with emergency response and the potential delivery of contraband or other payloads” along with the inability to detect, track, or mitigate a drone “can allow a single operator to complete a delivery, conduct surveillance, or create panic before a coordinated response can be mounted” (Lawfare Media, 2026, para. 5). On an offshore platform with thousands of tons of volatile materials, thousands of meters above a seabed through which major pipeline infrastructure runs, that operational consequence is not equivalent to a stadium disruption or a contraband delivery to a prison yard. The physical vulnerability of offshore energy assets to drone-delivered payloads is categorically different from the vulnerability profile for which the SAFER SKIES Act’s protective architecture was primarily designed.
The interim period between the SAFER SKIES Act’s December 2025 enactment and the DHS/DOJ implementing regulations expected in mid-2026 represents the highest-risk window for offshore energy operators. The legislative framework acknowledges the threat, the operational response architecture does not yet exist in any jurisdiction relevant to offshore assets, and the drones are not observing the rulemaking calendar. For offshore energy operators whose assets are exposed in this window, and whose exposure will not fully resolve when the implementing regulations are published, given the offshore jurisdictional gaps those regulations do not address, the practical security posture requires five integrated elements.
Detection infrastructure is the foundational requirement. Counter-UAS radar systems specifically designed for offshore environments — lightweight, weather-hardened, capable of detecting and tracking small-UAS in the sea clutter and electromagnetic interference environment that offshore installations generate — provide the situational awareness that any response, however delayed by response authority constraints, requires. Robin Radar’s offshore-specific analysis documented the technical characteristics that make this feasible: maritime-grade radar with appropriate clutter rejection, integrated with electro-optical cameras for visual identification and classification, mounted at positions on the facility that provide overlapping coverage of the full safety zone perimeter (Robin Radar, 2025). The detection capability creates the incident documentation record that regulatory reporting requires, the intelligence baseline that attribution analysis depends on, and the early warning that allows shore-based response assets to begin mobilizing while the incident is still in progress.
Pre-coordinated response protocols with relevant national authorities are the operational complement to detection infrastructure. The Norwegian model, Navy vessels positioned near offshore installations following the 2022 drone surge, represents the most developed existing framework for offshore drone response, and its limitations are instructive: naval vessel positioning provides a response presence but not a counter-drone capability, and the legal authority for the naval vessel to take action against a civilian drone remains ambiguous in the absence of a specific threat determination by appropriate authorities. Pre-established communication protocols between facility operators, the PSA, the Coast Guard, and naval authorities, in terms of defining the information that triggers each level of response, the timeline for escalation, and the authority chain for counter-drone action, compress the decision-making time that the response window requires. The OEUK’s development of security guidance with Police Scotland and the Department for Energy Security and Net Zero provides a UK model whose structure should inform analogous agreements across every North Sea jurisdiction.
The security assessment that offshore energy operators have most consistently deferred — integrating drone threat scenarios into their facility security assessments alongside the physical access control, personnel security, and cybersecurity frameworks that ISPS Code compliance requires, is no longer deferrable. A facility security plan that treats the airspace above the 500-meter safety zone as someone else’s problem has been written for a threat environment that ceased to exist when the first unauthorized drone appeared over the Sleipner platform.
Offshore energy infrastructure has become the most consequential unprotected airspace in the critical infrastructure security landscape. More than 100 North Sea wind farms, dozens of oil and gas platforms on the Norwegian Continental Shelf, and the subsea pipeline network connecting European energy supply are being surveilled by unidentified, unattributed drones that operators detect, report to authorities, and watch depart without consequence. The SAFER SKIES Act’s enactment in December 2025 represents the most important step forward in counter-drone legal authority in a generation, and yet its certification pipeline will produce only approximately 60 qualified officers by June 2026 against demand from 18,500 agencies, its implementing regulations are still pending, and its authority does not extend to private facility operators or to the offshore jurisdictions where the North Sea threat is most acute. What neither the Act nor its implementing regulations address is the fundamental jurisdictional reality that offshore energy assets are beyond the territorial authority of the law enforcement agencies the Act empowers, that the European frameworks governing North Sea infrastructure remain fragmented and underdeveloped, and that the actors conducting drone surveillance of these assets are aware of and operating within all of these limitations. Closing the offshore drone security gap requires detection investment, coordinated response protocols, integrated facility security assessments, and the sustained political will across nine North Sea states to build the governance framework that the Hamburg Declaration committed to and the April 2026 RUSI/EIES roundtable documented has not yet been built. The drones will not wait for it.
References
AeroDefense. (2026, April 24). The SAFER SKIES Act: A new era of counter-UAS authority for law enforcement. https://blog.aerodefense.tech/safer-skies-act-law-enforcement-counter-uas
AirSight. (2026, April 2). SAFER SKIES Act explained: Counter-drone authority for law enforcement. https://www.airsight.com/blog/safer-skies-act-counter-drone-law-enforcement
DroneLife. (2025, December 11). NDAA FY 2026: Key counter-UAS provisions explained. https://dronelife.com/2025/12/09/ndaa-fy-2026-key-counter-uas-provisions-explained/
DroneLife. (2026b, March 11). SAFER SKIES Act: FBI outlines counter-drone authority path. https://dronelife.com/2026/03/11/safer-skies-act-counter-uas-authority-fbi-droneresponders/
Euronews. (2026, May 16). Who protects Europe’s offshore wind farms from sabotage and drones? https://www.euronews.com/2026/05/16/europes-offshore-wind-power-is-vulnerable-to-attacks-who-is-responsible-for-protecting-it
HSToday. (2026, February 12). Safer skies at all levels: How new federal action reshapes counter-UAS authority and capability. https://www.hstoday.us/subject-matter-areas/airport-aviation-security/safer-skies-at-all-levels-how-new-federal-action-reshapes-counter-uas-authority-and-capability/
Kyiv Independent. (2025, September 30). Unidentified drone spotted over Norwegian gas field, police investigating. https://kyivindependent.com/unidentified-drone-spotted-over-norwegian-gas-field-police-investigating/
Lawfare Media. (2026, June). The counter-UAS certification bottleneck. https://www.lawfaremedia.org/article/the-counter-uas-certification-bottleneck
Offshore Magazine. (2022, September 27). PSA warns of unidentified drones around Norwegian offshore facilities. https://www.offshore-mag.com/special-reports/norway/article/14283340/psa-warns-of-unidentified-drones-around-norwegian-offshore-facilities
PBS NewsHour. (2022, October 23). Unidentified drones over Norway’s offshore platforms fuel fears of Russian threat. https://www.pbs.org/newshour/world/unidentified-drones-over-norways-offshore-platforms-fuel-fears-of-russian-threat
Robin Radar Systems. (2025, February 24). Protecting oil rigs from drones with counter-UAS radar. https://www.robinradar.com/blog/protecting-oil-rigs-from-drones-with-counter-uas-radar
Scandasia. (2022, September 29). Norway to position military to protect oil installations after drone sightings. https://scandasia.com/norway-to-position-military-to-protect-oil-installations-after-drone-sightings/
The Scotsman. (2026, April 30). Suspect drones and ‘reconnaissance’ ships target North Sea energy infrastructure. https://www.scotsman.com/news/uk-news/suspect-drones-and-reconnaissance-ships-target-north-sea-energy-infrastructure-8214672
