The legislative session in 2021 presented a multitude of interesting bills. Many will become law on July 1, 2021. One addresses our privacy and security, our property rights, and perhaps more. CS/CS/SB 44 is interesting. That designation means "committee substitute" for "committee substitute" for Senate Bill 44. There were multiple revisions, and this designation helps remind us that this bill evolved notably along its path from filing (12.28.20) to passage (04.28.21).
The title is "[a]n act relating to the use of drones by government agencies." The tin foil hat crowd might jump to the Skynet I-told-you-sos (The Terminator, 1984). No, at least not yet. The law, section 934.50, Florida Statutes, prohibits the use of drones by law enforcement to gather "evidence or other information." SB 44 amends that with "except as provided in subsection (4)." It will now be legal for law enforcement to use drones to:
provide a law enforcement agency with an aerial perspective of a crowd of 50 people or more (as long as the police agency has guidelines for the use, date retention/release, and for the safety of the crowd).
assist a law enforcement agency with traffic management (but, the police may not issue a ticket based on drone images/data).
facilitate a law enforcement agency’s collection of evidence at a crime scene or traffic crash scene.
assess() damage due to a flood, a wildfire, or any other natural disaster that is the subject of a state of emergency
There are also permissible uses for fire departments.
I long ago published Assume Everyone is Watching (September 2015) regarding cameras. More recently, I returned to conflicting rights and powers in Surveillance, Conflicting Rights, and Balance (May 2021). The common thread of these is that cameras are ubiquitous. As the Boys might put it, "I tell you (surveillance is) mighty wild, It's getting bigger every day," from Alabama to the ocean so blue. Cameras are everywhere, and now on drones. To be fair, these drones/cameras have existed for years, but now the state will be openly using them. This has the potential to make private property less private. Certainly, helicopters did that decades ago, but these drones are far cheaper to acquire and operate; therefore, the implications may be far broader.
The foregoing statute portions are interesting. But, the new law continues. There is a short window, "by January 1, 2022" for the Department of Management Services (DMS) to "publish . . . a list of approved manufacturers whose drones may be purchased or otherwise acquired and used by a governmental agency." That phrase may surprise some folks. Is it not fair to conclude that a camera, is a camera, is a camera? Once the list is published, "a governmental agency may only purchase or otherwise acquire a drone from an approved manufacturer" on that list. Furthermore, by "July 1, 2022, a governmental agency that uses any drone not produced by an approved manufacturer shall submit to the department a comprehensive plan for discontinuing" its use by January 1, 2023.
Some drones will be deemed acceptable, and others not. This law will rapidly define that and constrain which government operates. This leads back to the question is a camera, is a camera, is a camera? Why would anyone possibly care who manufactures the drone? Why is there government interest in this? The bill also requires, by January 1, 2023, that the DMS will establish a rule that will govern "minimum security requirements for governmental agency drone use to protect the confidentiality, integrity, and availability of data collected, transmitted, or stored by a drone." So, perhaps it is not the camera, but the extent of security that protects it?
In that, there is some recognition that cybersecurity is a persistent and pernicious concern. This blog has repeatedly returned to the topic of cybersecurity, and I am proudly hosting a discussion of it at the WCI in December. See Cybersecurity Hits Home (May 2021) and Cybersecurity, WCI 2021, the Pillory, and More (May 2021). In the simplest terms, a drone is merely a computer with the capability of flight; their size, mobility, and ubiquity may be of concern. The implications of small and light cameras are numerous, see Artificial Intelligence Surveillance (August 2020).
So what? So drones are computers. So computers store data. Old news? This blog previously noted an innovative method of acquiring data. Rather than working hard to infect your computer after you buy it, might someone strive to co-opt a device before you buy it, in the design or manufacture stage? See Hardwired Hacking (November 2018).
The Associated Press recently reported that the federal government has grounded some of its drones. Furthermore, a bill is making its way through Congress regarding drones. It is possible these particular drones will never fly again. The bill would "impose a five-year ban on U.S. government purchases of drones manufactured or assembled in China." AP concludes that the bill "reflects bipartisan concerns that devices made by companies such as DJI, which is based in Shenzhen, China, could facilitate Chinese spying on critical infrastructure."
Stop the presses! (I always wanted to say that).
Could it be that the same inappropriate hardwired hacking reported with other computer equipment could potentially be similarly employed with flying computer cameras? The Pentagon has recently issued a report noting that its investigation on concerns "found 'no malicious code or intent' in drone software made by DJI and used by the Interior Department." A critical word there may be "intent." Even if there is no design for content misappropriation, could it be that even the most innocent hardware could be hacked by the miscreant community that hacks people's data?
The AP article notes previous concerns of untoward harvesting of data from these drones due to "many unfixed software concerns." There is also a reference to a 2017 "document from U.S. customs authorities" that alleged "the drones likely provided China with access to critical infrastructure and law enforcement data." So, there is a suggestion that drones might misappropriate data, or at least be ineffective at protecting data. There is also some suggestion in the AP article that these efforts are just a matter of forestalling purchases while the U.S. drone manufacturers catch up in order to compete with the Chinese manufacturers.
The AP suggests that the federal bill might wreak havoc on state law enforcement. It notes that federal funds are used by those agencies, and their purchase of Chinese drones might be impacted or foreclosed by the new law. Of course, in Florida, that will soon depend in some part on which manufacturers are listed by DMS for approved use. And, there are some allegations of Chinese-made drones being donated to the government, which would obviate the constraint of federal money. Where the federal effort might frustrate purchase, the new Florida law appears to prevent use of even a gift drone.
The point of all of this is that we are all under surveillance. Often perhaps by happenstance (a security camera just happened to catch a building collapse recently). Not out of suspicion that something will happen (a building would collapse), but merely for the mundane of securing a parking area, providing a surf update, or any of a dozen other pedestrian purposes. There are just that many cameras out there pointed in that many directions. How secure their signals are is open for discussion. That they are on drones is already known and accepted. And now, their use by the government in Florida will likely increase. Therefore, it seems an appropriate time to consider the potential security risks that they may pose.
In a challenging time of evolving technology, distrust, and sometimes abject paranoia, drones are coming soon to a situation near you. Or, perhaps, they have been here already and we are just learning of their challenges? In any event, SB 44 illustrates yet again that our world is changing, technology is advancing, and we may each struggle to keep up.
