The White House has released new procurement guidance directing federal agencies to adopt strict cybersecurity standards for unmanned aircraft systems and accelerate the shift away from foreign-made platforms. The government-wide memo, issued by the Office of Management and Budget on Nov. 21, implements provisions of the American Security Drone Act and outlines new requirements intended to protect federal missions and support U.S. drone manufacturers.
Why Is OMB Warning Against Foreign-Made Drones?
The memo warns that drones produced by entities tied to foreign adversaries pose potential threats to federal networks and mission data, including unauthorized data capture, remote-access vulnerabilities, covert surveillance capabilities and supply chain disruptions. It states that heavy reliance on foreign-made systems also undermines domestic manufacturing capacity needed for federal operations.
What Cyber Safeguards Must All Federally Funded Drones Meet?
Agencies have 180 days to implement the cybersecurity safeguards for any drone purchased with federal funds, including those acquired through grants. Under the new policy, drones must be treated as both aircraft and IT systems, and must meet requirements, including:
- Multi-factor authentication for remote access
- Secure and verifiable software and firmware updates
- Encryption of data at rest and in transit
- Controls to block unauthorized data transfers
- Remote lock or wipe functions
- Deletion of high-confidentiality mission data after operations
The memo also directs agencies to assess during acquisition and solicitation development whether procurement from U.S. manufacturers is necessary to maintain domestic production capacity. It allows noncompetitive acquisitions when needed to support the U.S. industrial base.
When Do Restrictions on Foreign Drones Take Effect?
Starting Dec. 22, agencies may not use federal funds to purchase or operate drones listed as prohibited by the Federal Acquisition Security Council. Exemptions are limited to select national security agencies, including the Departments of War, Homeland Security and Justice. Those apply if certain procurements or operations serve a vital national interest.
These exemptions cover operations related to research, evaluation, training, testing and analysis for electronic warfare, cybersecurity or the development of UAS and counter-UAS technology; active missions such as counterterrorism, counterintelligence, protective services, or federal criminal and national security investigations; and UAS platforms modified to eliminate data transfer to foreign entities.
All waiver requests must be approved by the OMB director and reported to Congress.
How Will the Rules Apply to Grants and Federally Funded Purchases?
Federal agencies must incorporate the new drone security requirements into grant solicitations and evaluate proposals before awarding funds. Recipients will be subject to monitoring and review to ensure systems purchased with federal funding comply with the updated standards.
