In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody for flight logs and video, how to publish drone activity without exposing sensitive operations, and common mistakes […]
In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short.
He covers chain of custody for flight logs and video, how to publish drone activity without exposing sensitive operations, and common mistakes in open records handling. Drawing on his cybersecurity background, he points to risks in ground control software and spreadsheet logs. Donarski also offers practical advice for small agencies starting with little budget and looks at an FAA penalty case.
What do councils, records clerks, insurers, and auditors request from a drone program, and where do programs most often come up short?
Elected officials honestly couldn’t tell you the difference between 2.4 gigahertz and 5.8. They only start calling the chief when an upset citizen shows up at a podium claiming a department drone was hovering over a private fence. All councils really care about is dodging litigation and staying off the evening news. Take the records clerk in city hall. Pure paperwork triage. Open records deadlines hit like a freight train, and nobody downstairs has hours to spend tracking down patrol cars across town. The minute video gets lost on some unmarked thumb drive, the whole city ends up in legal non-compliance. What the clerk actually needs is dead simple, a dispatch call number, whoever was flying, and the video.
Risk adjusters and auditors only show up once carbon fiber hits the concrete. Say a prop clips a branch, shatters, and drops the airframe through the windshield of a car. The insurance adjuster doesn’t care how advanced the drone looked in a promotional video. They want cold documentation. Give them the airframe maintenance log, total motor runtime, charge counts on that exact pack, and paperwork proving the pilot didn’t let their Part 107 certification lapse six weeks prior. Auditors are even drier. They compare budget burn against physical flight time to see if training hours were fabricated or misallocated.
Programs completely drop the ball on chain of custody and basic indexing. An operator fliesthirty minutes on scene, shuts down, and tracks nothing except raw stick time on an app. Nobody tags the battery installed in the drone, nobody notes the call number, and nobody records a checksum when pulling the card. When defense counsel files a motion for all maintenance and flight telemetry tied to an arrest six months later, nobody can put the puzzle back together. The airframe history is split across random spreadsheets and personal notebooks, and the agency ends up looking completely incompetent in front of a judge.
How should an agency publish drone activity publicly without exposing sensitive operations? What are the trade-offs between aggregate counts and itemized logs?
I handle this the exact same way I configure firewall zones. Routine utility traffic gets passed straight through to the interface, but sensitive internal movements stay cordoned off. Take something like surveying a retention pond for public works, running orthomosaics on city-owned roofing, or scanning treelines for a dementia patient who walked away from memory care. That kind of flight belongs on a public dashboard before the batteries even recharge. Leaving ordinary civil flights in the dark is how departments accidentally spark rumors about secret government spy rings. But when operators launch overwatch on a barricaded subject or back up a regional warrant team, operational security takes absolute priority. Those sensor logs and CAD entries have to stay locked in evidence until the case clears trial and statutory holds expire.
The friction between aggregate statistics and itemized ledgers usually comes down to public credibility. Dropping a quarterly report claiming your unit flew 40 public-safety missions keeps your tactical methods shielded, sure. But the neighborhood sees right through generic bullet points. To an investigative journalist or a civil-rights monitor, high-level summaries just read like polished PR evasion. That said, posting raw geospatial feeds is a tactical disaster waiting to happen. Publishing raw GPS tracks gives everyone with a web browser the blueprint to your staging points, sniper posts, or the driveway of a protected informant. The real answer is a coarse itemized log. Publish the flight date, a wide two-hour launch window, the call classification, the tail ID, and the general patrol district. Keep exact coordinates and track vectors off the public site. Pair those lines with broad quarterly totals to give local taxpayers honest accountability without handing suspects your playbook.
What are the most common mistakes in public records and FOIA handling for drone footage and flight data?
A lot of squads treat a quadcopter like a shiny gadget rather than evidence gear. Police spent ten brutal years in court fighting over dash cams and body cams. They wrote thick binders on chain of custody, bought redaction suites, and built digital vaults. Then they buy an off-the-shelf drone, run a flight, pull the flash card, toss an MP4 into an unindexed desktop folder, and call it a day. The courts see zero difference between cameras pinned to a vest and cameras hanging from an airframe.
The other huge trap is raw data hoarding. A deputy spins the props, hits record on the pad, and lets the sensor run non-stop until the skids touch back down. Flying across town to reach the scene means capturing every pool, trampoline, and back deck on the way. If your city attorney hasn’t signed off on an auto-delete policy for non-evidentiary transit footage at 30 days, all of that incidental background video is public property under state law. One open records request lands, and your records clerk spends two weeks blurring out private backyards.
And people totally skip the flight logs. A subpoena for flight records covers far more than video clips. Opposing counsel wants pitch, roll, throttle inputs, altitude graphs, and GPS time codes. Leaving telemetry off the records ledger is an easy way to get chewed out by a judge.
Given your cybersecurity background, what are the real risks in flight logs and ground control software, such as data exposure, tampering, and chain of custody?
From a red-team angle, ground control stations and flight logs are massive, wide-open surfaces that people treat like dumb appliances. Most ground stations run on standard Android or iOS tablets. Out of the box, those operating systems want to talk to cloud services. Unless IT strips background syncing and hardens the OS, your coordinates, waypoints, and video metadata can bounce right off third-party servers without the pilot even knowing. Even worse, pilots in the field connect those tablets to open hotspots or unsegmented city Wi-Fi, turning a drone controller into a bridge right into internal municipal networks.
Then you run into the integrity issue. An incredible number of departments still keep their flight logs on flat Excel sheets. In digital forensics, a spreadsheet is worthless. Anyone with write access can open a cell, backdate an inspection, change an engine runtime, or wipe an unauthorized flight completely, and there is zero audit trail. If you get dragged into federal civil litigation, an opposing forensics expert will tear an unhashed spreadsheet apart on the stand.
Evidentiary weight requires an unbroken chain of custody on machine data. The raw log file straight off the airframe, the DAT, TXT, or CSV, needs a SHA-256 hash calculated the second it hits your ingestion box, followed by automated ingestion into write-once storage. Without automated hashing, you cannot prove to a judge that an operator didn’t tweak the altitude numbers or coordinates after touching down.
What would you tell a small agency starting a drone program with almost no budget?
Put the credit card away and write your policy first. Small departments make the mistake of scraping together a few grand, buying a drone off a shelf, and flying calls before they even have a written rulebook. Hardware is the cheap part. The lawsuits, records violations, and regulatory fines are what end up bankrupting you.
Before that drone ever leaves the foam case, write down your standard operating procedures, your flight authorization triggers, your privacy boundaries, and your data retention schedule. Take those documents to your city attorney and your council, and make them sign off on what the aircraft is allowed to do, and more importantly, what it is strictly banned from doing.
Operational discipline doesn’t care about your budget, either. You can run a five-hundred-dollar setup with the exact same rigor as an air medical chopper unit, and it costs next to nothing. You print your own checklists on heavy paper stock in the back office, clip them to a board, and actually use them. I tell guys to take a cheap paint pen, write big numbers right on the plastic shells of their batteries, and log how many times each pack gets cycled. If pack #3 only gives you fourteen minutes of hover before voltage sags, you want the pilot to know that before lifting off over traffic. Make it a hard department rule that nobody packs the drone back into its case until stick time and battery numbers getwritten down. Period.
On the technical side, treat the ground station like a dirty device. Do not let userss connect the controller to public coffee shop Wi-Fi or local guest networks to update maps in the field. Turn off every background cloud backup setting on the OS. Flash drives and SD cards should get yanked immediately at the station, moved onto restricted local network storage, and hashed out via quick terminal script before shift change. Get those field mechanics dialed in while your fleet is just one lonely bird, because cleaning up sloppy operational habits once you have three squads flying is nearly impossible.
Can you share one or two real examples of a program that got this right or wrong? Anonymized is fine.
Look at what happened with Gorge Drones out in Stevenson, Washington, if you want to see how fast things go south. The FAA slapped them with a proposed penalty of $289,215 across roughly fifteen agricultural spraying jobs. Nobody collided with a Cessna. Nobody dumped a chemical tank onto an elementary school playground. That whole massive fine came down to sloppy paperwork and ignoring foundational flight rules. When the FAA went through their operation, the craft didn’t have valid tail registration. They skipped the airworthiness paperwork. Nobody held the Part 137 agricultural certificates or the Section 44807 heavy waivers, and the pilots didn’t have the commercial credentials to legally spray crops with heavy birds.
Most people looking at Gorge Drones fail to realize how federal enforcement math works. An inspector doesn’t pull out a pad, hand you one nominal ticket, and walk away. They treat every single takeoff as its own compounding liability. Unregistered airframe? That is one violation. Uncertified operator on the sticks? Second violation. Unauthorized commercial flight envelope? Third violation. Multiply that across fifteen jobs, and suddenly an outfit is looking at almost three hundred thousand dollars in fines. A hit like that puts a private ag business in the grave.
In a city government setting, an audit finding like that triggers angry council hearings, claws back department funding, and gets the whole unit shuttered by morning roll call. When you cannot physically prove compliance with real logs on every single launch, regulators simply write you down as non-compliant across the board.
