Recent reports of drone sightings in Denmark, Norway and Germany have re-emerged the discussion about the protection that exists, or rather does not exist, at European airports. In Sweden, there are annual reports of various forms of remotely piloted vehicles near critical infrastructure. Deviation reports from the Civil Aviation Authority indicate that remotely piloted vehicles that maintain themselves near airports are a real threat from both an aviation safety and security perspective. In 2024, the Civil Aviation Authority received 23 reports of drones that were within the control zone at its airports, mainly at Arlanda and Visby. The Swedish Transport Agency, which collects information from all airports in Sweden, states that there have been 46 incidents involving drones or similar objects that were assessed to have had an impact on the safety of manned aircraft. The number of reported incidents has gradually increased since 2020.[1] The alarms at Kastrup Airport and its impact on air traffic show how major the consequences of the presence, or mere suspicion of the presence, of drones can have.
At a Nordic drone conference in Oslo, a snapshot of drone use in the Nordic countries was presented. The results indicated that at the time of the survey, there were 795,000 drones for commercial and private use in Sweden. A high figure compared to the number of registered drone operators, which is just over 42,000. Which is also the highest number among the so-called N8 countries.[2] The discrepancy between the number of drones and the number of operators can be partly explained by the fact that not all drones require the individual to be a registered operator and that an operator can own several drones. At the same time, it is likely that a large number of users in Sweden fly without either the statutory “drone card” or as a registered drone operator. The latter may be due to both ignorance and deliberate action as the risk of “getting caught” is low, and that the penalty for, for example, flying without a drone card is unclear at the time of writing.[3]
Civil society's need for protection against drones, so-called "Counter-Unmanned Arial Systems (CUAS)", has been a topic that has been discussed for a long time. Especially in connection with drone sightings at major international airports such as the British Gatwick (2018) and Heathrow (2019) which caused major disruptions to air traffic. The topic has subsequently been re-emerged in a broader sense after Russia's attack on Ukraine. The discussion has moved from dealing with non-kinetic and passive means in the form of detection systems, to now dealing with a broad arsenal of tools ranging from jamming to traditional air defense resources. The recurring attacks on Ukrainian cities by Russian/Iranian drones, together with drone attacks targeting rescue operations, show how protection against drones is not only a military issue but also of importance to civil society, and thus to total defense, where the need for protection extends all the way from preventing hostile intelligence operations to physically protecting them from attacks by unmanned vehicles. The spectrum of potential threats creates a challenge in itself, but the greatest challenge lies in what measures civil society can, and by law may, take here and now and in an ongoing war.
A growing market with increased interest among the public in flying this type of craft also means a likely increase in false alarms. Which in turn can affect the tendency to report and act on detected craft depending on the environment in which the observation takes place. Where Swedish security services have struggled for decades to make the population feel a healthy suspicion of everything unknown, a new dimension is now being added with drones as the normal image. Not to mention that within the EU it is possible to take your drone to another EU country and fly. Which will probably in the future become as natural as driving a car or moped abroad.
Not just a threat in war
Security threats fall into five different categories: foreign intelligence, terrorism, subversion, sabotage and crime. The latter is probably a bit forgotten when we discuss drone threats. It can get a bit overshadowed by the threat from foreign intelligence, which can be difficult to distinguish from crime, especially when foreign intelligence agencies use criminal elements to carry out various actions.[4] Today we see how Mexican cartels use drones in the same way as in Ukraine to fight competitors or to fight back against the state and law enforcement. It is also not an unknown phenomenon that drug cartels use various forms of remote-controlled vehicles to smuggle drugs. The same is happening in Ukraine across the border. In Sweden, there have been cases where, like in the USA, drones have been used to smuggle both drugs and mobile phones into the country's prisons, and where drones have been used to spy on the police.[5] In Dublin, Ireland, a drone armed with a grenade was used in a suspected gang clash.[6] Even though the Swedish Police have stepped up and built their own drone capabilities as well as CUAS, they require that there is a way to get to where the capabilities are needed. If criminal actors, who have so far shown very little interest in not harming innocent people, start adopting the same tactics seen in Mexico, society risks falling into a new spiral of violence, similar to the previous ones with shootings and bombings.
In hybrid warfare, the scenario of criminal actors using drones on behalf of a foreign intelligence service for both reconnaissance and sabotage or, in the worst case, direct violence against personnel within the total defense is entirely realistic. Especially with a Russia that has in various ways demonstrated an increased risk appetite to achieve its goals.[7] It is important that the entire civil society understands that the threat is not limited to military defense and thus some remote stores in a forest. The threat is directed primarily at the entire society and the infrastructure that we all rely on daily to be able to get to work, drop our children off at preschool or shop for the weekend movie night.
The team room
As small drones have become more common in society, the need for various regulations has also increased. Above all, to reduce the risk of innocent people being injured by drones falling over a crowd or of manned aircraft colliding with a hobby drone. The regulatory framework that existed previously, which primarily regulated the flying of remote-controlled model aircraft, was not sufficient in this context, and there were also several examples of how drone pilots simply did not know or understand how and where they were allowed to fly. This is by no means an exclusively Swedish problem.
In 2020, the EU introduced a series of regulations that regulate how drones of different weight classes are allowed to fly.[8] The rules impose a number of requirements on the vehicle in order to, for example, be allowed to fly over people or beyond visual range. In general, the rules mean that civilian drone operators who fly as a hobby are allowed to fly no higher than 120 meters above the ground. This in itself is no obstacle to making a commercial vehicle like the DJI Mavic fly higher if the operator so wishes by modifying the software or using older vehicles.[9] By using a "home-built" FPV, it is also possible to get around the limitation and be able to fly without any height restrictions.
The rules are also designed in such a way that vehicles weighing less than 250 grams do not require a so-called “remote ID”. The purpose of “remote ID” is for a vehicle to continuously broadcast its unique ID number and position over the air as long as it is in the air. In addition, the operator’s position is also broadcast. This means that a private person with an application on their phone, or a police officer with a special receiver, can read each airborne vehicle’s unique ID number and where its operator is. In this way, the idea is that a person who flies without permission over, for example, a crowd or protected object can be quickly taken into custody and the flight interrupted. The problem is that this only applies to vehicles weighing 250 grams and above. In connection with the introduction of the EU regulations, the market began selling vehicles that weighed 249 grams and were therefore not affected at all by the requirement for “remote ID”.
In Sweden, however, the regulations have been designed so that anyone who flies a craft that is “equipped with a camera, sound recording or other sensor” must register as an operator in the Swedish Transport Agency’s operator register. The unique operator ID must then be affixed to the drone. The craft that are currently exempt from this requirement are drones that are only flown indoors, drones that are tethered with a cable or craft that are classified as toys. The cost for an individual to be registered as an operator is currently 250 SEK annually. It is likely that an individual who buys a commercial drone to be able to film nice holiday films has little motivation to register as an operator and also pay an annual fee. It is also unlikely that that person will apply for a distribution permit from Lantmäteriet before images or film clips are published on social media.[10] Especially when the processing time is over two months.
The Swedish legislation on the dissemination of geographic information aims to protect information that is important for the total defense. It is a legislation that few people are probably aware of as it has mainly affected those who have photographed from airplanes or from boats out at sea. A drone is considered an aircraft in the sense of the law and thus it means that photos or films taken with the drone are also affected by the legislation. Which by extension means that when there is a threat of war in Sweden, the government can decide to ban photography from the air. This type of ban can also be made during a heightened state of alert within designated restricted areas, which in turn means increased powers to respond to unknown aircraft for those who are assigned to monitor and defend these areas.
However, the regulations surrounding drones are in an early stage and it will take time before, for example, prosecution of individuals who do not comply with the regulations can catch up, which means that it is associated with low risk today to fly without both a drone license and an operator ID. It will therefore take time before it becomes natural for someone who buys a drone to also understand that they need to get a drone license, or at least register and thereby learn about the applicable legislation.
Protection against UAVs, more than just interference
One misconception that we need to address directly is that CUAS is about buying a technical product (usually a jammer) to solve the problem with, for example, drones. This may not be an explicit or conscious misconception, but the attitude is recurrent in, for example, news reporting where the ability to act against drones is linked to the technical systems that can jam remote-controlled vehicles. It is possible that it is precisely this narrative that has also made it difficult for the civilian part of the total defense to build a CUAS capability. Jamming is one method among several for influencing unmanned vehicles.
There needs to be a reporting chain that handles observations and confirms the reporter. A recurring criticism of security reporting is that a report is perceived to disappear into a “black hole” and no feedback is given to the reporter at all. This risks discouraging the willingness to report in the future because the person reporting rarely feels appreciated and may instead choose to seek out the media. Sometimes it is enough to get in touch and thank them for the report and announce that it is being handled and that no further information can be provided in the case. Effective CUAS capabilities are based on the fact that there are several different types of sources of warning, including people who observe deviant behavior. This should not be underestimated, but it also means a vulnerability as the quality of observations can decline as news reporting increases. Something that became very clear in connection with the suspected drone sightings at Arlanda in 2024. The number of reports of suspected drones increased in line with the increased news reporting. Among other things, flights and stars were reported as suspected drones, which resulted in an increased burden on the Police.
A reporting chain can also include technical solutions in the form of sensors that can register activity in the area in various ways. Unlike jammers, it is basically free to listen in on the airwaves. Thus, there are opportunities for all civilian actors to build technical alarm systems that can detect and locate drones (and their operators). These can then be linked with security guards to try to interrupt ongoing activities. In addition, it is fully permissible to have radar that can be used to detect small flying objects or to build acoustic systems that can distinguish an engine on a remotely controlled platform from an engine on other flying platforms. The latter can be said to be an underutilized technology to assist in both detection and classification of drones and whether they are carrying any kind of cargo.
The action taken in the event of an alarm may vary depending on the circumstances. Since there are strict restrictions in law on who is allowed to have a jammer, the measures need to be designed accordingly. A decision that needs to be made in each situation is whether the company's own operations should be suspended or continued. For airports, this may mean canceling all takeoffs and redirecting flights to alternative airports. Arlanda closed its airspace for a couple of hours, which resulted in delays as well as redirections.[11] It is conceivable that threats from unmanned vehicles will have similar consequences when they are directed at both ports and railways. Russia has experienced the latter when Ukrainian vehicles fought Russian logistics trains on Russian territory. It is also entirely possible to allow operations to continue despite alarms and an imminent threat, including to save lives. Something that can be seen, for example, in Ukraine where rescue services respond to put out fires and save lives after drone attacks despite the threat of becoming targets themselves in a follow-up attack.
CUAS is categorized within the Armed Forces in part as troop air defense and the images disseminated from Ukraine show various forms of weapon solutions for shooting down drones near large cities. It is therefore easy to link protection against drones with air defense and thereby fall into the trap of believing that it is solely a military responsibility. In order to effectively protect both critical installations and civil society at large, however, we need to think more broadly about the issue and look at how both industry and critical civilian infrastructure can be protected without taking military resources from other operations. Sweden has a historical legacy from the Cold War where there were so-called operational defenses for socially critical activities and infrastructure. Previous defense preparation reports have proposed the reintroduction of an organization similar to the former operational defense, something that, for example, Svenska kraftnät has taken a positive stance towards.[12] A reintroduction of drift defense, if realized, could have the potential to become an important component of the total defense against unmanned vehicles. With an expansion of which actors are allowed to possess and use jammers as well as pure armament (similar to the idea of drift defense at the time), the conditions would be created for a defense in both breadth and depth, while at the same time allowing military defense to be concentrated on critical nodes for, for example, host nation support (VLS).
In summary
There is no doubt that civil society in several areas needs to develop protection against remotely piloted vehicles and continuously practice everything from reporting to mass casualty outcomes. In order to be able to develop adequate protection, however, significantly more permissive legislation is required where civil defense and actors that operate critical infrastructure can procure and use electronic countermeasures. Protection itself is not just about airports and nuclear power plants, it is largely about being able to protect all personnel within the total defense when they work. The risk is imminent that the development we see in Latin America, Africa and to some extent in Europe will also reach Sweden, which means that the threat may become highly topical in the near future. However, there is still time to begin work in parallel on several levels to prepare civil society so that protection is on par with military defense. That would be a highly desirable investment in total defense.