Companies Are Forbidden to Stop Drones

On the morning of October 12, 2000, a small boat masquerading as a garbage barge in the harbor at Aden, Yemen, came alongside the USS Cole, the destroyer I commanded. In a split second, two al Qaeda suicide bombers detonated an improvised explosive device against the hull of our ship, killing 17 of my sailors.

Twenty-six years later, I have made my peace with it. I was the one held accountable, and I had responded appropriately to a threat the intelligence community never anticipated and never equipped me to stop. What I cannot accept is watching my own country knowingly put American companies that provide critical infrastructure in that same position.

The company that owns the electric substation feeding your neighborhood can watch a drone fly over it, but that is nearly the end of what it may lawfully do. The same is true of the refinery outside your town, the port that moves your goods, and the data center holding your private medical records. These companies may point a camera at the drone and call the police.

That is the law working exactly as Congress wrote it. And that's the problem.

Congress handed counter-drone authority to state and local law enforcement last December. The Justice Department and Homeland Security wrote the implementing rule this summer, and they wrote it for those agencies and no one else. Private companies that own most of America's critical infrastructure are not mentioned in it at all.

Set those owners aside for a moment and look at the agencies the rule was written for. They cannot use it either. The certification to bring a drone down belongs to the officer, not the department. A city can send someone to Alabama for two weeks for training, and the day that officer rotates out, goes on leave, or retires, the city is back to calling the FBI and waiting. 

One campus in Alabama certifies every officer in the country cleared to do it. The government hopes to reach 150 agencies within two years, but there are roughly 17,500 in the United States. And because this authority does not expire until the end of 2031, nothing forces anyone in Washington to fix any of it for five years.

The FAA then appeared to offer companies a remedy and withdrew it in the same document. Its proposal this May would let the operator of a critical facility petition for a flight restriction over his own plant, while stating that the restriction provides no relief from federal criminal law for using equipment "designed to detect, take control of, destroy, or otherwise interfere with an unmanned aircraft." A company may ask Washington to declare the sky above its reactor off limits. It still may not lawfully buy the gear to find out who is flying there.

The domestic threat is real. In November 2024, a Tennessee man was arrested outside Nashville and charged with attempting to use a weapon of mass destruction after preparing to fly an explosive-laden drone into an electrical substation. He pleaded guilty in September 2025.

Last November, the North American Electric Reliability Corporation (NERC) ran the largest grid security exercise on the continent. More than 28,000 people worked through a scenario in which drones struck the switchyard of a nuclear generating station. What the industry took away from it was not that switchyards need hardening. It was that utilities, in the words of a NERC vice president, are only "limited to engaging with UAS only after they are safely on the ground, which is often too late."

No competent officer would accept rules of engagement that limit their response until after the weapon has functioned. That's how casualty reports and obituaries are written in advance.

In July 2025, a House Homeland Security subcommittee convened a panel on the drone threat to the homeland. Every seat went to a company with something to sell: two drone manufacturers, a counter-drone vendor, and the industry's trade association. Not one utility, port, refinery, or pipeline operator was at the table.

Congress should extend to the companies that own the infrastructure the same authority it gave police, attach the certification to the institution instead of the individual, and stop routing every certification in the country through one campus in Alabama.

When something does happen at one of these sites (and it will), nobody is going to ask whether the company had the legal authority to act. They are going to ask what it did. I have sat in that chair and would not wish that scenario on anyone. Especially when the law has expressly forbidden people to act.

CDR Kirk S. Lippold, USN (Ret.), commanded USS Cole (DDG 67) when it was attacked by al Qaeda terrorists in October 2000. 

image: In this photo provided by Ukraine's 93rd Kholodnyi Yar Separate Mechanized Brigade press service and taken Saturday, Aug. 22, 2026, fragments of a Russian FPV drone are caught in the anti-drone net against the background of an abandoned apartment building in the frontline town of Druzhkivka, Donetsk region, Ukraine. (Iryna Rybakova/Ukraine's 93rd Mechanized Brigade via AP)