Citing National Security Needs, the FCC and FAA Take Steps on UAS Regulation

The commercial drone sector has grown rapidly in recent years, leading to escalated security concerns over unauthorized unmanned aircraft system (UAS) incursions near critical infrastructure and sensitive facilities. At the same time, long-standing congressional mandates designed to address mitigation of potential threats of UAS operations have awaited implementation. Section 2209 of the Federal Aviation Administration (FAA) Extension, Safety, and Security Act of 2016 directed the agency to establish a process for restricting drone flights over critical infrastructure.¹ On the spectrum side, the Federal Communications Commission (FCC) has grappled with how to accommodate UAS operations in an increasingly congested radio frequency environment while addressing the legal uncertainties surrounding counter-drone technologies.

These two actions arrive at the same moment, and they address different elements of the same challenge: The FAA notice of proposed rulemaking (NPRM) addresses the airspace and physical security side of the drone ecosystem, while the FCC proceeding addresses the spectrum and communications side. Critical infrastructure owners, drone operators and counter-UAS technology developers should be engaged in both proceedings.

FAA Section 2209 NPRM: Drone Restrictions Over Critical Infrastructure

Legislative History and White House Directive

Section 2209 was enacted as part of the FAA Extension, Safety, and Security Act of 2016 and directed the FAA to establish a process by which operators of certain critical infrastructure facilities could apply for restrictions on drone operations in close proximity to their sites. The U.S. Congress originally set a January 2017 deadline for implementation. The NPRM, published in the Federal Register on May 6, 2026, represents the first formal step toward fulfilling that mandate nearly a decade later.

President Donald Trump's June 6, 2025, executive order (EO), "Restoring American Airspace Sovereignty," directed the FAA Administrator to promptly submit an NPRM to the Office of Management and Budget and the Federal Task Force to Restore American Airspace Sovereignty, which the EO established, and promulgate a final rule as soon as practicable. The EO further directed the FAA Administrator to coordinate with the Sector Risk Management Agencies, U.S. Department of War Secretary, U.S. Department of Homeland Security Secretary or U.S. Attorney General, as appropriate, to make national security and homeland security assessments as appropriate.

Structure of the Proposed Rule

The proposed rule would create a new regulatory framework under 14 C.F.R. Part 74. In essence, it proposes to establish a petition-based system: Facilities would not automatically receive protected status but would instead apply through a new FAA portal and demonstrate that restrictions are necessary based on factors, including aviation safety, protection of people and property on the ground, national security or homeland security concerns. The proposal repeatedly emphasizes that restrictions would apply only to "fixed-site facilities," not broad geographic areas or temporary events.

The proposed rule would establish two levels of restricted airspace.

• A Standard Unmanned Aircraft Flight Restriction (UAFR) would allow operators of qualifying fixed-site facilities to petition the FAA for defined airspace in which drone operations would be restricted. Approved restrictions would become part of FAA airspace information systems used by drone pilots and flight planning applications.²
• A Special UAFR would impose stricter controls at sensitive federal sites and certain endorsed fixed-site facilities. Under that framework, drone operations would be prohibited unless operators received advance approval from both the FAA and the sponsoring federal agency. Special UAFRs could remain in place for up to five years. The affected airspace may also be designated as national defense airspace under 49 U.S.C. Section 40103(b)(3), carrying potential criminal penalties for violations, pursuant to 49 U.S.C. Section 46307.

Notably, for Standard UAFRs, operations that occur under 14 C.F.R. Parts 91, 107, 108, 135 or 137 – which encompasses almost all commercial UAS operations – can still "transit the airspace in the shortest practicable time" within such a restricted area, provided the aircraft operator notifies the holder of the Standard UAFR. Brief operations can occur, therefore, without affirmative permission but rather with advance notification. This flexibility does not apply, however, to recreational UAS operations. In addition, in order to take advantage of the flexibility that Subpart G of the proposed rule requires, the operator must broadcast remote ID at all times, consistent with 14 C.F.R. part 89.

Eligible Facilities: 16 Critical Infrastructure Sectors

The FAA proposes to limit UAFR eligibility to facilities that meet the federal definition of critical infrastructure under 42 U.S.C. 5195c(e) and fall within one of 16 critical infrastructure sectors. Those sectors are chemical; commercial facilities; communications; critical manufacturing; dams; defense industrial base; emergency services; energy; financial services; food and agriculture; government facilities; healthcare and public health; information technology; nuclear reactors, materials and waste; transportation systems; and water and wastewater. The NPRM also references statutory categories listed in Section 2209, including energy facilities, oil refineries, chemical plants, railroad facilities, amusement parks and state prisons.

In addition to proposing eligibility in the 16 above-listed sectors, the site must meet additional criteria:

• The facility in the site must have critical assets or components that would be vulnerable to the capabilities that UAS could exploit.
• The site owner or proprietor must establish that any damage, disruption or destruction of the facility would have a regional or national-level debilitating effect.
• The site must be a fixed site, rather than temporary or mobile, with protective security.

The FAA has explicitly invited public comment on whether the above framework, especially the 16-sector categorization model, is the appropriate scope of eligibility for such sites. The FAA also seeks comment on whether other facility types should qualify.

Enforcement and Remote ID

The NPRM does not create new counter-UAS authority or authorize facilities to use jamming, spoofing, geofencing, drone capture, or any form of interdiction or mitigation technology. That separation between airspace designation and counter-drone authority is deliberate: The two remain legally distinct.

Instead, the proposal outlines how violations could be enforced using existing FAA and law enforcement authorities. Site operators would be able to contact law enforcement if a drone enters restricted airspace, and authorities could then use Remote ID data to identify the operator or locate the drone's control station. The restrictions are intended to help law enforcement distinguish between lawful and unauthorized drone operations near sensitive facilities by establishing a clear legal boundary: The threat of civil or criminal penalties for violating protected airspace would encourage lawful operators to steer clear, allowing security personnel to focus on rogue drones more likely to pose actual threats.

Transit and Commercial Operator Access

Proposed Section 74.250 would allow drones operating under Parts 91, 107, 108, 135 and 137 to transit a Standard UAFR if they broadcast Remote ID under Part 89, transit in the shortest practicable time and notify the facility per Section 74.255. This means commercial operators conducting real estate photography, beyond-visual-line-of-sight (BVLOS) delivery operations, agricultural spray operations and cargo flights would all retain the ability to transit Standard UAFRs subject to those requirements. Recreational flyers operating under 49 U.S.C. 44809 are notably not included in that transit provision. The FAA has invited comment on what additional UAS operations should be allowed through a UAFR and what economic impact would result if commercial operators are not permitted to transit. The FAA is accepting public comments on the proposed rule through July 6, 2026.

State Law Overlay: Florida Critical Infrastructure Restrictions

Though the FAA's Section 2209 proposal would create a federal petition process for UAS flight restrictions over fixed-site facilities, stakeholders should also consider whether state law imposes independent restrictions. Florida provides a useful example: Its recently enacted Unmanned Aircraft Systems Act prohibits knowing or willful operation of a UAS over a "critical infrastructure facility." Under the recently enacted statute, drone operators must not 1) make contact with such a facility or 2) operate close enough to interfere with or cause a disturbance to the facility. The statute also prohibits altering a UAS in a manner that contravenes FAA Remote ID requirements, and violations of Section 330.41(4)(a), Florida Statutes, may be prosecuted as third-degree felonies.

Florida defines "critical infrastructure facility" to include a wide array of facilities, from correctional institutions and detention centers to a broad swath of energy facilities or certain manufacturing plants. The statute contains important exceptions, including for federal, state or other governmental entities and their contractors; qualifying law enforcement agencies and persons acting under their direction; and an owner, operator or occupant of the critical infrastructure facility, or a person with prior written consent from such owner, operator or occupant.

For operators and infrastructure owners, the practical takeaway is that state statutes concerning consent and privacy may need to be evaluated alongside the federal proceedings such as the Section 2209 NPRM. Florida's Unmanned Aircraft Systems Act also amended Section 934.50, Florida Statutes, to create criminal exposure for certain drone imaging of tenants or privately owned real property undertaken with intent to conduct surveillance in violation of a reasonable expectation of privacy and for intentional distribution of such surveillance.

FCC Public Notice on Enabling Counter-UAS Operations

On April 1, 2026, the FCC's Wireless Telecommunications Bureau (WTB) and Office of Engineering and Technology (OET) released Public Notice DA 26-314, seeking comment on an array of reforms the Commission might take to support American UAS and counter-UAS operations. The proceeding spans three dockets: GN Docket No. 26-74, WT Docket No. 22-323 and WT Docket No. 24-629. As described in a previous Holland & Knight alert, comments were due May 1, 2026, and reply comments are due May 18, 2026.

The FCC described the Public Notice as the "next major step" in the FCC's efforts to promote U.S. drone leadership by "cutting red tape, modernizing obsolete regulations, and securing a domestic drone supply chain." The proceeding is designed to build a robust administrative record that could support future FCC rulemakings or other actions, though it does not commit the agency to any specific regulatory path at this stage.

Key Topics on Which the FCC Sought Comment

The Public Notice is structured around several distinct policy areas, each with specific technical questions.

• Spectrum Access for UAS: The Public Notice indicates the FCC is fully aware that most drones in the U.S. currently rely on unlicensed spectrum (the same frequencies used by Wi-Fi routers and other consumer devices) for their command-and-control communications. The FCC seeks comment on permitting more intensive UAS operations in licensed flexible-use commercial wireless bands, including the 800 MHz Cellular band, Citizens Broadband Radio Service (3.5 GHz), 960-1164 MHz, 1670-1675 MHz, 1.4 GHz, 2.3 GHz and 3.7 GHz bands. The FCC also asks how to expedite implementation of initial rules it adopted in 2024 for the 5030-5091 MHz band, which has been allocated for drone use but has not yet been put into service.
• Modernizing UAS Licensing: WTB and OET seek input on creating a dedicated UAS experimental license category with more flexible terms, longer license periods, broader geographic scope and expedited renewals. The Public Notice also asks whether the FCC should 1) explore a blanket experimental authorization for qualified drone developers and 2) implement pre-cleared test ranges or corridors in coordination with the FAA and National Telecommunications and Information Administration.
• Testbeds and Innovation Zones: The FCC seeks comment on expanding its Innovation Zone program to support large-scale testing of drone technologies, including whether to create new testbed sites designed for defense companies, maritime environments or sparsely populated regions where interference risks are lower.
• Clarifying the Permissible Use of Counter-UAS: Counter-UAS refers to technologies, systems or operations designed to detect, track, identify and, where authorized, mitigate or disable UAS that pose a threat to safety, security or regulatory compliance. Although the FCC's rules do not specifically regulate counter-UAS as a discrete category, the Communications Act and FCC regulations may pose barriers to deployment. In particular, Section 333 of the Communications Act of 1934 provides that "[n]o person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter." That statute creates a direct legal problem for any counter-drone system that disrupts a UAS signal, even one posing an active threat. The FCC asks how to address the Section 333 barrier and whether its Part 5 experimental licensing rules should be revised to remove restrictions that limit counter-UAS to research and development purposes and currently prohibit operational mitigation or enforcement use cases.
• Modernizing Coordination: The FCC seeks comment on whether existing coordination or notification procedures designed to protect spectrum users from harmful interference restrict UAS or counter-UAS operations more than necessary and if it would be feasible to streamline those requirements.

Initial Comments Filed

Multiple major wireless carriers and equipment manufacturers filed comments supporting licensed spectrum as the foundation for scalable drone operations. Several urged the FCC to remove the existing prohibition on airborne use of 800 MHz cellular equipment, citing advances in massive multiple-input and multiple-output antenna systems as enabling better interference management for UAS. A leading wireless trade association highlighted the key role of existing carrier networks in supporting nationwide drone operations.

Commenters in the counter-UAS and defense stakeholder community recommended using existing FCC legal mechanisms and making targeted rule changes to enable counter-UAS testing and operational deployment. Several filings addressed the Section 333 legal barrier and proposed frameworks for distinguishing between detection, tracking and identification functions on the one hand and active mitigation on the other. One state aviation agency drew a line between six distinct functions (detection, tracking, identification, situational awareness, communications testing and mitigation) that it argued should not be treated as a single regulatory category.

A major drone trade association called for operator flexibility across licensed, unlicensed and flexible-use bands depending on mission requirements and flagged downstream consequences of the December 2025 FCC Covered List expansion on U.S. operators who remain dependent on imported subsystems, including flight controllers, sensors, cameras and batteries. Industry groups also called for deletion of airborne restrictions in the 800 MHz and Citizens Broadband Radio Service bands, accelerated deployment of the 5030-5091 MHz band through a federal advisory committee and issuance of experimental authorizations through a streamlined process.

Multiple utility coalitions, including a joint filing from major electric utility associations, identified the 5030-5091 MHz band as essential for infrastructure-scale BVLOS UAS operations. The band was approved for drone use in 2024, but final implementing rules remain pending.

Next Steps

The near-term regulatory calendar includes several key dates. Reply comments in the FCC proceeding are due May 18, 2026. Comments on the FAA NPRM are due July 6, 2026. Following the conclusion of the comment periods, both agencies will presumably review the record and move toward final action.

For the FAA, the Section 2209 rulemaking will proceed through the standard notice-and-comment process before a final rule is issued. The legislative directive required the FAA to "establish a process," while the June 6, 2025, EO directed the agency to "promulgate a final rule as soon as practicable after publication of the NPRM." For the FCC, the Public Notice is a record-building exercise that does not commit the agency to any specific regulatory path; any changes to the FCC's rules would require additional agency-level action, likely through an NPRM.

Stakeholders interested in UAS and security measures should monitor parallel developments, including the ongoing FCC Covered List litigation, FAA and Transportation Security Administration BVLOS rulemaking and legislative activity related to counter-UAS authority.

Holland & Knight's Drone Team is available to respond to questions regarding these proceedings or other matters relating to UAS regulation and critical infrastructure protection. If you have any questions or need assistance, contact the authors or another member of the team.

Notes

¹ Pub. L. 114-190 Section 2209 (July 15, 2016) (Applications for Designation).

² The FAA plans to list UAFRs in FAA Order JO 7400.12.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.