What police need before they can stop a drone

A year ago I wrote a report here called who can legally stop a drone over your house. The answer then was short. Four techniques, four separate federal statutes, and a very small list of federal entities exempt from any of them. Local police were not on that list.

They are now, conditionally, and the conditions are the story. I spent my Army career in counter-IED and electronic warfare, which means I have operated the category of equipment this rule governs and I have written the coordination paperwork that goes with it. Reading the interim final rule, what I recognized was not a grant of authority. It was a deconfliction regime, and a fairly strict one.

What the rule actually is

The document is an interim final rule from DOJ and DHS jointly, published in the Federal Register on Monday 6 July 2026, at volume 91, number 127, pages 41466 through 41516. It creates parallel parts at 6 CFR part 124 and 28 CFR part 124. The Departments describe its job in the summary:

In this interim final rule ("IFR"), the Department of Justice ("DOJ") and the Department of Homeland Security ("DHS") (collectively, "the Departments") codify the framework for implementing the SAFER SKIES Act, which authorizes State, local, Tribal, and territorial law enforcement or correctional ("SLTT") agencies to conduct counter-unmanned aircraft system ("C-UAS") operations.

Two dates matter and they are in an unusual order. The rule took effect on 1 July 2026, five days before it was published. The comment period ran until 4 September 2026. The Departments used the Administrative Procedure Act's good-cause exception to skip notice and comment before issuing it, and they are candid about the standard they are invoking, quoting the D.C. Circuit against themselves:

"[T]he good cause exception is to be narrowly construed and only reluctantly countenanced."

Their argument is impracticability, the emergency branch, resting on the immediacy of the drone threat and a statutory deadline. Reasonable people will disagree about whether that fits. What is not in dispute is the practical consequence: every agency that stood up a program this summer did so under a rule that was already binding while the public was still being asked what it thought of it. The Departments say they welcome post-promulgation comment on all aspects, and the docket is FBI-2026-0001.

The two certifications, and the one that cannot shoot

The training structure is the first thing an agency runs into. The Act requires a national schoolhouse as sole certifying authority for mitigation, and the rule designates the FBI's National Counter-UAS Training Center as that schoolhouse.

The split people miss is that certification is not only for mitigation. The Departments read the statute as reaching detection too, because detection and warning are among the actions the Act describes, and an agency may act only after completing the required training. So there is a separate Detection and Warning Certification for agencies that only want to see drones, and the rule is explicit that holding it is not a partial license to act. Section 124.12 "prohibits any mitigation action by personnel holding only a Detection and Warning Certification."

That is worth sitting with, because it is the opposite of how most equipment authorities work. Usually the lesser qualification lets you do the lesser thing in an emergency. Here it does not. An officer with detection certification watching a drone descend toward a stadium is, under this rule, an officer who may warn and may not engage.

One more distinction that will save agencies money: the rule governs operations conducted under the Act's authority. Detection systems that need no relief from federal law are outside it. The Departments say so directly, and they go out of their way not to retroactively judge existing deployments, noting the rule "does not adjudicate the lawfulness of detection activity conducted before the effective date."

You cannot buy your way onto the list

Equipment is constrained by a two-list framework. The Authorized Technologies List names categories of technology, maintained jointly by DOJ, DHS, DOD, DOT and the FAA, the FCC, and NTIA. The Authorized Systems List names specific systems inside those categories, and it is being populated in phases as systems clear interagency assessment, with listings tied to "the approved capabilities, functions, and hardware version of the system."

Read that last clause as a procurement officer. A listing attaches to a hardware version. A vendor shipping a firmware revision is not obviously shipping the listed system. Agencies buying now are buying into a list that does not yet exist for most categories, and until it does they are limited to the technology categories, which is the limit the statute itself imposes.

The spectrum gate

This is the part I would put at the top if I were briefing a chief, and it is buried in section 124.9.

Most coverage describes the federal coordination as a single portal submission that routes to the FBI and DHS for deconfliction, to the FAA for airspace, and to the FCC for spectrum. That is right, and it undersells one asymmetry that the Departments state plainly:

Consistent with 6 U.S.C. 124n, the airspace process is one of coordination, not approval; however, an SLTT agency may only conduct C-UAS operations once the C-UAS Operations Plan is approved under § 124.8. As to the FCC, however, the process is one of coordination and authorization not mere coordination.

And the reason, which is the sentence that matters:

Because 6 U.S.C. 124n does not displace 47 U.S.C. 301, an SLTT law enforcement or correctional agency must obtain the authorization it needs from the FCC before operating a C-UAS system that emits radio waves (such as certain radar systems), and FCC coordination alone does not suffice.

Section 301 is the provision that makes it unlawful to transmit radio energy without a license. Congress gave police counter-drone authority. It did not give them spectrum. Those are different sovereignties and the Act did not merge them.

If you have worked electronic warfare this is completely familiar, and it is the single most common misunderstanding I encountered in the field. People think of a jammer as a weapon pointed at a target. It is not. It is a transmitter, and a transmitter does not know whose receiver it reaches. I wrote about this here in the jammer that jams you: the counter-IED jammers in Iraq degraded the radios and GPS of the units they were protecting, because that is what broadband RF energy does in a volume of space. Spectrum authorization is not bureaucratic friction bolted onto a police power. It is the mechanism by which somebody checks whether your protective bubble lands on an airport approach, a hospital paging system, or the radios of the officers on the far cordon.

The Departments know this is a bottleneck. They commit to pursuing standing or categorical authorizations and a vendor equipment authorization pathway "as a priority," and note the FCC can issue expedited waivers under 47 CFR 2.1204 in the interim. Until those exist, an agency with a radar-based detection system and no FCC authorization has bought a device it may not legally turn on.

Telling air traffic control, and why the rule covers nets too

Section 124.11 requires real-time notification to air traffic control on activation of any C-UAS system for mitigation, at five minutes or as soon as operationally practicable, plus a follow-up confirming when the action ends. The Departments chose that over fixed advance notice because "mitigation against a credible threat is time-sensitive and often cannot be predicted far enough in advance to permit prior notice."

Their reasoning for why the requirement applies to non-emitting methods as well is the part that shows somebody thought about physics rather than paperwork:

Activation of an RF-emitting mitigation system can affect aircraft operating near the protected area, by interfering with their communications systems, so real-time notification allows the FAA and air traffic control to account for the mitigation action, issue advisories, and deconflict other aircraft while the system is active. A mitigation action that does not emit radio frequency energy can likewise affect the airspace near the protected area, for example by bringing an unmanned aircraft down or creating falling debris, so the same real-time air traffic awareness is warranted whether or not the system emits radio frequency energy.

Both halves of that are correct and they are correct for different reasons. The RF half is spillover into other receivers. The kinetic half is that a successful intercept converts a flying object into a falling one, over ground you selected for its value. A net gun that works produces debris. That is not an argument against nets. It is an argument for the airspace next to you knowing it happened.

The rest of the gates, briefly

Several more sit between authority and action, and an agency needs all of them.

Each operation requires a C-UAS Operations Plan on a standardized form prescribed by the Attorney General, signed by an Agency Approving Official and supported by a legal counsel certification, valid for a 30-day operational window or a 365-day standing window for fixed-site persistent protection. The agency also needs an implementation policy covering command responsibility, integration with its use-of-force policy, operator rostering, equipment control, privacy procedures and recordkeeping, reviewed by its own counsel and attested through the portal. That one is self-certified rather than pre-approved, with the training center retaining audit and suspension authority.

For large events there is lead-agency tactical coordination, and it has teeth: an agency that declines to accept tactical coordination "cannot conduct C-UAS operations within the area and period covered by the lead-agency designation." Afterwards there is a 48-hour report to the Attorney General and the Secretary of Homeland Security giving date, time, location, the credible threat or safety concern, the mitigation capability used and any known operational effects, feeding a semiannual summary and a congressional report.

Privacy runs through section 124.14, including a First Amendment limitation on using the authority solely to monitor protected activity, minimization requirements, a 180-day retention limit on records of communications with statutory exceptions, and an audit trail. Enforcement is real money: the Act authorizes a civil fine up to $100,000 per violation or suspension of C-UAS authority, with the rule adding graduated penalty levels.

Two limits deserve their own line. The rule "does not authorize action against any aircraft operated with a human pilot, crew, or passengers onboard." And the whole authority terminates on 31 December 2031 under the statute's own sunset, with obligations and proceedings arising beforehand surviving it. An agency budgeting a ten-year capability is budgeting past the expiry of the law that permits it.

What this changes, and what it does not

The honest summary is that the ceiling moved and the floor did not.

For a police department with a budget, a legal office, and the patience for federal coordination, the answer to "can we do something about drones over the stadium" changed from no to yes-with-paperwork. That is a genuine shift, and after seven years of federal-only authority it is overdue.

For a homeowner, a stadium owner, or a private security company, nothing changed at all. This rule runs to State, local, Tribal and territorial law enforcement and correctional agencies. Everything in the earlier report still applies to everyone else, and the arrival of a lawful path for police does not create one for the client who calls them. If you own a property with a drone problem, your remedy is still to call an agency that holds a certification, which today is a small number of agencies.

And the technical ceiling has not moved either. A rule about who may act does not change what the equipment can do. The drone that is hard to stop today, the fiber-controlled one or the fully autonomous one flying a pre-loaded route with its radio off, is exactly as hard to stop by a certified officer as by an uncertified one. I have written about that gap in stopping a drone you can't jam, and this rule does not touch it. Authority and capability are separate axes, and only one of them moved in July.

What I did not verify

My primary source is the interim final rule itself, which I downloaded as the Federal Register PDF and read directly, not through a summary. Everything quoted above is from that document. Both federalregister.gov and the Justia mirror refused automated access, so the file came from GPO's govinfo repository at the FR-2026-07-06 package; the canonical Federal Register citation is in the sources.

I did not read the SAFER SKIES Act as enacted, and I did not read 6 U.S.C. 124n directly. Where I describe what the statute requires, I am describing what the Departments say it requires, in their own section-by-section analysis. That is the normal reading of a rule, but it is second-hand as to the statute, and if the Act says something the Departments characterized loosely, this report inherits that.

I have not read the comments filed in docket FBI-2026-0001 and I do not know what the final rule will say. The comment period closed on 4 September 2026, three days before this was published. A final rule can change any of the details above, and the FCC pathway is the provision most likely to move, since the Departments themselves flagged it as a priority for further work. This report describes the interim rule as it stands in September 2026 and will need a dated update when a final rule issues.

I have also not verified how many agencies have actually been certified. The training center is a single schoolhouse, mitigation certification requires attendance there, and the Authorized Systems List is being populated in phases. Those three facts together suggest that adoption in the first year will be much slower than the headlines imply, but I did not find a published certification count and I am not going to estimate one.