In January 2026, El Paso International Airport closed, not due to weather, mechanical failure, or a security breach at the terminal, but because an unauthorized drone penetrated its airspace, forcing the suspension of flight operations (AirSight, 2026). It was not the first such incident, and it will not be the last. During the 2024 NFL season, an unauthorized drone flew over a packed M&T Bank Stadium in Baltimore during a playoff game, prompting federal charges against the operator and a temporary disruption to game operations. On Christmas Eve 2024, mysterious drones appeared hovering over critical infrastructure in West Feliciana Parish, Louisiana, including facilities that the public had no business knowing the precise layout of (AirSight, 2026). The New Jersey drone sightings of late 2024, which produced 49 reports in a single day in Hunterdon County alone and prompted the FBI Assistant Director of the Critical Incident Response Group to tell Congress that he simply did not know who was responsible or why, illustrated with uncomfortable clarity that the United States government’s ability to detect, attribute, and respond to drone activity near sensitive locations was, at that moment, profoundly inadequate (Fox News, 2024). What followed was the most consequential reorientation of domestic drone security policy in the history of the technology: a cascade of executive orders, legislative action, federal guidance, and $500 million in new grant funding, all converging on the recognition that the sky above American facilities, events, and critical infrastructure is no longer a neutral space, and that the security frameworks treating it as one are dangerously obsolete.
The foundational challenge in drone security for private facility operators and event organizers is not technological. It is legal. For years, the authority to neutralize an unauthorized drone, to jam its communications signal, intercept its flight path, or physically disable it, resided exclusively with the federal government and a narrow set of federally authorized entities (CBS News, 2026). A port authority, a power plant operator, a stadium security director, or an event organizer watching an unidentified drone circle their facility had, until very recently, essentially two options: call the FBI and wait, or do nothing. The FBI’s statistics on this gap are instructive: of 121,000 requests for federal counter-drone support to stadiums and other venues submitted between 2018 and 2025, only 77 were approved (Flying Magazine, 2026). The arithmetic of that ratio, fewer than one in a thousand requests resulting in federal action, captures the structural inadequacy of a system in which every drone threat required federal authorization to address, while the threats themselves multiplied without reference to authorization.
The NFL’s testimony before Congress documented the scale of the stadium problem with specificity: more than 2,000 drone incursions per season for each of the preceding three years, a figure that grew from 67 incidents in 2018 to 2,845 in 2023, a trajectory that tracks with the explosive growth in commercial drone availability and capability (DroneXL, 2025). Prison systems have faced a comparable escalation: contraband delivery by drone has become a systematic operational challenge for correctional facilities across the country, with documented cases ranging from drug packages to cell phones to weapons dropped into exercise yards by coordinated drone operators positioned outside facility perimeters. A drone does not need to destroy a facility to affect it. It needs only to disrupt it, such as forcing an airport to suspend operations, triggering a stadium evacuation, enabling surveillance of a facility whose layout would otherwise remain operationally secure, or delivering a payload that initiates a chain of events inside a perimeter that no ground-based security measure could have prevented.
The Fiscal Year 2026 National Defense Authorization Act’s SAFER SKIES Act provisions represent the most significant shift in this legal landscape since the federal government first established counter-drone authorities in 2018. The legislation extends drone mitigation authority — the legal right to detect, jam, intercept, and take down unauthorized UAS — to state, local, tribal, and territorial law enforcement agencies, moving beyond the exclusive federal authority model that had left facility operators and state governments functionally helpless in the face of drone threats at all but the largest and most politically prominent events (FEMA, 2025; Flying Magazine, 2026). Senator Tom Cotton’s Critical Infrastructure Counter-UAS Act, introduced in April 2026, takes the next step: extending limited counter-UAS authority directly to a subset of private operators of designated high-risk critical infrastructure facilities, such as nuclear plants, key substations, and bulk-power system control centers, whose trained security personnel could take action against credible drone threats under federal oversight (CBS News, 2026). The legislation reflects a growing congressional consensus that the legal framework has lagged so far behind the operational threat that private critical infrastructure operators are being held responsible for security outcomes they lack the legal authority to achieve.
In November 2025, the Cybersecurity and Infrastructure Security Agency released three new guidance documents under its “Be Air Aware” campaign, the most comprehensive federal guidance ever issued specifically for critical infrastructure operators on UAS threat management (CISA, 2025a). The three documents — “Unmanned Aircraft System Detection Technology Guidance for Critical Infrastructure,” “Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators,” and “Safe Handling Considerations for Downed Unmanned Aircraft Systems” — were developed with government partners, UAS experts, and industry representatives across critical infrastructure sectors, and were explicitly linked to Executive Order 14305, “Restoring American Airspace Sovereignty” (CISA, 2025b; Inside Unmanned Systems, 2025). CISA Acting Director Madhu Gottumukkala framed the release with precision: “The new risks and challenges from UAS activity demonstrate that the threat environment is always changing, which means our defenses must improve as well” (CISA, 2025a, para. 2).
The detection technology guidance establishes a three-stage framework that any serious facility security assessment must now incorporate. The first stage is establishing capability requirements through a structured risk assessment: identifying high-value assets, profiling likely threat actors, and categorizing the specific UAS threat scenarios relevant to the facility — surveillance drones collecting intelligence about operations or personnel, weaponized drones carrying payloads, contraband delivery systems targeting controlled environments, or intrusion drones designed to test perimeter security response (CISA, 2025c; The Robot Report, 2026). The second stage is selecting site-appropriate detection technology based on the physical environment, operational tempo, and threat profile: radio frequency detection systems that identify the command-and-control signals of commercially available drones, radar systems capable of tracking small low-altitude objects, and optical sensor arrays that provide visual identification and classification capability at operationally useful distances (FEMA, 2025). The third stage is integration, meaning embedding drone detection into existing security and emergency response plans rather than treating it as a standalone system, programming automated responses to detected drone activity, and ensuring that the human professionals receiving drone alerts are trained to assess threat credibility and execute proportionate responses (CISA, 2025c).
The CISA guidance’s emphasis on integration — on layered, coordinated security architecture rather than siloed technology procurement — reflects the same principle that has proven decisive in every other domain of physical security: a sensor that detects a threat creates an obligation to respond to it, and the quality of that response is determined entirely by the trained human professionals who receive the alert, assess its meaning, and execute the appropriate action. A radio frequency detector that identifies a commercially available drone in the airspace above a power substation has accomplished the detection function. What happens in the next 90 seconds, whether the facility operator knows the relevant protocols, whether law enforcement has been pre-coordinated, whether the facility’s operations can be adjusted to reduce the drone’s intelligence collection value, is a function of operational planning, trained personnel, and exercised response procedures, none of which any sensor system provides on its own.
The 2026 FIFA World Cup — eleven host cities, sixty-four matches, an expected attendance of five million spectators across the tournament, and a global television audience measured in the billions — has become the operational crucible in which the United States is field-testing its new counter-drone architecture at scale. FEMA’s December 2026 announcement of $250 million in Counter-UAS Grant Program awards to the eleven World Cup host states and the National Capital Region — disbursed in what the agency described as the fastest non-disaster grant program in its history, with awards issued just 25 days after the application deadline — represents the federal government’s most direct acknowledgment that large-venue security now has an airspace dimension that cannot be addressed through ground-based security measures alone (FEMA, 2025; Inside Unmanned Systems, 2025). The total C-UAS Grant Program, established under the One Big Beautiful Bill Act of 2025 and signed into law by President Trump in July 2025, allocates $500 million over two fiscal years — $250 million in FY2026 for World Cup host states and a second $250 million in FY2027 distributed to all 56 states and territories as the capability becomes a permanent national infrastructure rather than an event-specific deployment (FEMA, 2025).
The Washington National Guard’s December 2025 counter-drone exercise at Seattle’s Lumen Field — a World Cup host venue — is the operational template for what this looks like in practice: a simulated drone attack on a stadium, executed with realistic commercial UAS platforms, testing the detection infrastructure, the response coordination between state law enforcement and federal authorities, and the communications protocols that determine whether a suspicious drone is identified as a recreational flight, a media drone, or a credible threat requiring immediate action (Flying Magazine, 2026). The simulation is necessary because the threat categories are genuinely difficult to distinguish in real time. The same commercially available quadcopter platform can be a licensed news media drone, an authorized event production asset, an ignorant recreational pilot who missed the temporary flight restriction notification, or a deliberately deployed surveillance or payload delivery platform. The human professional making that determination in the moment, such as the security director, the law enforcement officer, the counter-drone operator, needs training, protocols, and a pre-established command authority structure that has been exercised before the event, not assembled during it.
Missouri’s allocation of $14.24 million for six World Cup matches at Arrowhead Stadium between June 16 and July 11, 2026, provides a concrete illustration of the per-venue investment that serious counter-drone security now requires (DroneXL, 2026). The FEMA grant metrics — tracking system usage hours, detections, unique UAS events, and criminal investigations launched — reflect a performance accountability framework that treats counter-drone capability as an operational function with measurable outcomes, not a technology acquisition that can be checked off a procurement list (Inside Unmanned Systems, 2025). Only law enforcement agencies whose personnel have completed or enrolled in FBI counter-UAS training at the National Counter UAS Training Center in Huntsville, Alabama, can receive mitigation equipment under the program, establishing a training and certification requirement that acknowledges, at the federal level, that the human professional operating counter-drone mitigation technology is as critical to the system’s effectiveness as the equipment itself (Flying Magazine, 2026).
The global counter-drone market is projected to grow at a compound annual growth rate of nearly 30 percent over the next decade, reaching a total value exceeding $30.5 billion by 2034 (The Robot Report, 2026). That trajectory reflects both the scale of the threat and the scale of the investment being mobilized against it, but it also reflects a market dynamic that the CISA guidance was specifically designed to correct. A rapidly expanding technology market in which vendors compete to position their systems as comprehensive solutions, selling to facility security managers who face board-level pressure to demonstrate that they have “addressed the drone threat,” creates precisely the conditions in which procurement substitutes for planning, sensor deployment substitutes for operational capability, and the appearance of protection substitutes for its substance.
The Fox News analysis of the domestic drone vulnerability captured the operational reality that technology procurement alone cannot address: in the current environment, it is easier to buy and operate a drone than it is to legally stop one, and “a drone does not need to destroy a facility to have impact, it only needs to disrupt one” (Fox News, 2026, para. 4–5). A temporary shutdown at a port, airport, or power substation ripples across supply chains, economic activity, and public confidence in ways that are disproportionate to the physical cost of the drone operation itself. The asymmetry of that cost-impact ratio, meaning cheap for the attacker, expensive for the defender, implies that drone-based disruption is structurally attractive to every threat actor category from criminal opportunists to state-sponsored adversaries, and that facilities which have not built genuine counter-drone operational capability are accepting exposure they may not have fully modeled.
The path to genuine resilience combines what the CISA guidance describes as the “Harden, Obscure, Perimeter” infrastructure strategy — concealing, hardening, or relocating critical assets or operations vulnerable to aerial threats; restricting access and using signage to create deterrent effect; and identifying likely UAS launch and landing zones to support law enforcement response — with the trained human professionals who can translate sensor data into operational decisions and coordinate the multi-agency response that drone incidents increasingly require (CISA, 2025b). Facility security assessments that have not been updated to incorporate UAS threat scenarios, event security plans that treat the airspace above the venue as someone else’s problem, and critical infrastructure protection programs that define perimeter security exclusively in ground-based terms are not aligned with the threat environment that 2026 has made visible. The federal government has now invested in the legal framework, grant funding, and training infrastructure to address this gap at the state and local levels of law enforcement. The parallel question for private facility operators, event organizers, and critical infrastructure owners is whether their security programs have made the same transition — from treating the sky as neutral to treating it as the operational domain it has become.
The drone threat to facilities, events, and critical infrastructure has crossed the threshold from an emerging concern to an operational reality, and the federal government, through CISA guidance, FEMA grant funding, the SAFER SKIES Act, and Senator Cotton’s pending legislation, is now mobilizing substantial resources to address it. The World Cup will be, in effect, the first large-scale operational test of the new counter-drone architecture — eleven cities, sixty-four matches, $250 million in federal investment, and the most concentrated deployment of state and local counter-UAS capability in American history. The lessons from that test will shape how drone security is operationalized at stadiums, ports, power facilities, and public events for the decade that follows. For the facility operators and event security directors who will be responsible for the security outcomes of venues that do not have FBI counter-drone teams assigned to them, the lesson is already clear: the sky is no longer a neutral space, the legal framework to address what moves through it is finally catching up with the threat, and the organizations that have built the trained human capability to act on what their detection systems tell them will be positioned to protect the people and assets in their care. Those who have purchased sensors without building the operational capacity to act on what those sensors detect will have spent real money to create the appearance of security without its substance.
AirSight. (2026). Latest news on drone detection and countermeasures. https://www.airsight.com/en/news/all
CBS News. (2026, April 23). Sen. Tom Cotton pushes bill to allow drones to be stopped by critical infrastructure operators. https://www.cbsnews.com/news/tom-cotton-bill-drones-downed-critical-infrastructure-operators/
Cybersecurity and Infrastructure Security Agency. (2025a, November 19). CISA releases new guides to safeguard critical infrastructure from unmanned aircraft systems threats. https://www.cisa.gov/news-events/news/cisa-releases-new-guides-safeguard-critical-infrastructure-unmanned-aircraft-systems-threats
Cybersecurity and Infrastructure Security Agency. (2025b). Protect critical infrastructure and public gatherings. https://www.cisa.gov/topics/physical-security/be-air-aware/protect-critical-infrastructure-and-public-gatherings
Cybersecurity and Infrastructure Security Agency. (2025c). Unmanned aircraft system detection technology guidance. https://www.cisa.gov/resources-tools/resources/unmanned-aircraft-system-detection-technology-guidance
DroneXL. (2025, November 27). White House pushes Congress for drone-killing powers. https://dronexl.co/2025/11/27/white-house-congress-drone-killing-powers/
DroneXL. (2026, January 2). FEMA’s $500M counter-drone program launches with World Cup funding. https://dronexl.co/2026/01/02/fema-500m-counter-drone-program/
Federal Emergency Management Agency. (2025, October 28). FEMA announces over $1 billion in federal funding to secure the FIFA World Cup games and protect Americans. https://www.fema.gov/press-release/20251028/fema-announces-over-1-billion-federal-funding-secure-fifa-world-cup-games
Federal Emergency Management Agency. (2025). Counter-unmanned aircraft systems grant program fact sheet. https://www.fema.gov/fact-sheet/counter-unmanned-aircraft-systems-grant-program-fact-sheet
Federal Emergency Management Agency. (2025). Counter-unmanned aircraft systems grant program: Frequently asked questions. https://www.fema.gov/fact-sheet/counter-unmanned-aircraft-systems-grant-program-frequently-asked-questions
Federal Emergency Management Agency. (2025). Notice of funding opportunity: Counter-unmanned aircraft systems grant program. https://www.fema.gov/fact-sheet/notice-funding-opportunity-nofo-counter-unmanned-aircraft-systems-c-uas-grant-program
Federal Emergency Management Agency. (2025, December 30). In a historic announcement, FEMA rapidly awards $250 million to secure U.S. skies ahead of the FIFA World Cup 2026. https://www.fema.gov/press-release/20251230/historic-announcement-fema-rapidly-awards-250-million-secure-us-skies-ahead
Flying Magazine. (2026, January 3). FEMA awards $250M to stop drone pitch invaders at World Cup. https://www.flyingmag.com/fema-250m-counter-drone-world-cup/
Fox News. (2024, December 10). FBI leader says it’s ‘concerning’ how little his agency knows about mysterious drones seen over New Jersey. https://www.foxnews.com/politics/fbi-agency-concerning-mysterious-drones-new-jersey.amp
Fox News. (2026). Drone incursions at U.S. military bases expose civilian infrastructure risk. https://www.foxnews.com/opinion/americas-power-grid-food-supply-threat-drones
Industrial Cyber. (2025, November 21). CISA releases UAS detection guides to help critical infrastructure counter drone threats. https://industrialcyber.co/cisa/cisa-releases-uas-detection-guides-to-help-critical-infrastructure-counter-drone-threats/
Inside Unmanned Systems. (2025, November 20). CISA rolls out new UAS security guides for critical infrastructure operators. https://insideunmannedsystems.com/cisa-rolls-out-new-uas-security-guides-for-critical-infrastructure-operators/
Inside Unmanned Systems. (2025, December 31). FEMA fast-tracks first $250 million in C-UAS grants to World Cup host states. https://insideunmannedsystems.com/fema-fast-tracks-first-250-million-in-c-uas-grants-to-world-cup-host-states/
The Robot Report. (2026, February 21). Visual drone detection moves into critical infrastructure playbooks. https://www.therobotreport.com/visual-drone-detection-moves-into-critical-infrastructure-playbooks/
