Off the Shelf: The Violent Nonstate Actor Drone Threat

Airpower has historically been scarce for its costs and complexities, commercial UAVs can affordably replace or supplement military-grade models for certain tasks. As a result, the range of actors leveraging airpower’s unique attributes is growing in number and variety, making tactical air control more challenging. We contend that it is not only resource-constrained states taking to the air with commercial platforms but also violent nonstate actors (VNSA). For instance, the Islamic State in Iraq and the Levant (ISIL) has flown hundreds of UAV sorties against Western and Middle Eastern troops. Sending up swarms of drones costing a few hundred dollars each, the US admitted a lapse in tactical superiority of the airspace during the battle of Mosul. Thus, with the advance of small UAVs, the range of airborne actors is even broader, and their capabilities are even more diverse. Our objective in this study is to highlight and describe the scope and potential impact of the VNSA drone threat.

Violent nonstate actor drone use is more widespread, diverse, sophisticated, and rapidly advancing than depicted in the nascent literature. The reason is that until recently, scholars have neglected or conflated commercial drones with military-grade platforms. Looking only at the latter, proliferation is restricted to three Iranian state-sponsored terror groups in the Middle East—Hezbollah, Hamas, and Houthi rebels. Including commercial technologies, our original dataset on VNSA drone incidents features 40 separate groups covering every continent except Antarctica. Terrorist-operated drones constitute a security concern for two reasons:

1)  they grant VNSAs a new offensive edge in conflict, and 2) they increase defensive challenges for security providers. In the next section, we describe where commercial drones sit on the spectrum of UAV technologies and why they are attractive to VNSAs. We then discuss how drones offensively benefit terrorist groups and defensively challenge state actors. Finally, we trace several successful VNSA drone use cases in three broad theaters—international, domestic, and aviation security.

Definitions and Scope

UAVs, or drones, span a broad spectrum of capabilities and types. On the lowend, they include hobbyist drones that many individual consumers can afford and operate with little instruction, including children. On the high-end, the spectrum features exquisite platforms such as the RQ-170 Sentinel, the stealthy “Beast of Kandahar.” The Department of Defense classifies UAVs according to gross weight, speed, and altitude. As UAV technologies advance, however, technical specifications might blur across boundaries as commercial drones attain higher performance and military-grade models miniaturize or specialize with proprietary subcomponents. Consequently, we employ Kelley Sayler’s taxonomy of drones, based on accessibility and technical and infrastructural requirements to operate. She sets forth four categories: hobbyist, commercial and mid-sized military, large militaryspecific, and stealth combat. The higher the category, the less accessible, and the more intensive the requisites become to operate and maintain the UAV. VNSAs predominantly use hobbyist and commercial UAVs (civilian drones), and a select few use Iranian mid-sized military drones. This use puts them squarely along the lower end of the UAV spectrum. The reason is that civilian drones are affordable, accessible, and user-friendly. Hobbyist drones have the lowest entry barriers, being low-cost (i.e., a few hundred dollars), unregulated, and with minimal technical or infrastructural requirements. For instance, ISIL’s drone of choice was the DJI Phantom, a popular hobbyist model manufactured in China.

Commercial drones are more expensive (ranging from thousands to tens of thousands of dollars), might entail regulation in some cases, and have higher capacity requirements. However, these drones are still attainable by many VNSAs. Midsized military drones have similar capacities but are more costly and heavily regulated, requiring state-sponsorship for VNSAs to attain. Like less endowed states, VNSAs cannot attain large military-specific and stealth combat drones for their costs, legal restrictions, and complexity. Even constrained to civilian drones, however, VNSAs can leverage airpower’s unique attributes to advance their agendas. As private-sector technologies progress, they will increasingly benefit from these simpler platforms. There are also potential dangers of VNSAs scavenging, reverse-engineering, and deploying downed military-operated drones. In May 2012, an allied raid on a Taliban base in Helmand Province yielded a small drone, thought to be a North Atlantic Treaty Organization (NATO) model. Turkish security forces found a US RQ-20 Puma during a search of a Kurdistan Worker’s Party (PKK) cell in Silopi in early 2016.15 Later that year, Jabhat Fatah al-Sham published a Telegram post featuring photos of a downed Russian surveillance drone in the Jabal alAkrad, the “Mountain of the Kurds,” expressing intentions to reverse-engineer it. In 2016 alone, ISIL seized 18 military-grade drones (2 US RQ-7 Shadows, a US MQ-9 Reaper, an unspecified US reconnaissance drone, 13 Iraqi UAVs, and a Kurdish reconnaissance model). With most of these seizures, the group merely boasted and threatened on social media. However, some outlets reported that a Shahed-129, a fairly advanced Iranian UAV, was fielded by an insurgent group against US forces in 2017. While the operator has not been positively identified, some sources suggest that ISIL obtained the machine following a crash and recovery. Although our focus remains on more accessible civilian drones, we foresee that VNSAs assimilating commercialized airpower will become adept across an increasing bandwidth of UAV technologies, further problematizing security in a drone-dense future.

The Threat

Gaining access to cheap civilian drone technology has granted VNSAs a new offensive edge. Though VNSAs have had limited aerial capabilities for some time—balloons, missiles, rockets, even hijacking commercial planes—civilian UAVs are more affordable and versatile. They are more agile and inconspicuous than balloons. They are more multiuse and reusable than missiles and rockets. They are lower risk and less costly than sending operatives aboard a commercial plane to disrupt its flight. Consequently, civilian drones provide VNSAs a new, efficient platform to advance their agendas. Though Hurst emphasizes the challenges of tactical air control as more states deploy small UAVs, we submit that civilian models benefit VNSAs at all levels. At the strategic level, they are using drones for propaganda generation, both to advertise their newfound aerial capabilities and their effects and to publish striking cinematography of other operational successes. At the operational level, they use UAVs for intelligence, surveillance, and reconnaissance (ISR) and to enhance command and control (C2) in real-time. At the tactical level, civilian drones open access to otherwise unreachable targets, such as rear headquarters and transit routes, extending the range of VNSAs’ lethality. By offering mobility, flexibility, and covertness in the launch location relative to an attack site, they lower risks for violent groups that might enable protracted campaigns.

In addition to boosting VNSAs’ offensive edge, civilian drones increase defensive challenges for security providers. Many have been aware of, preparing for, and succeeding against malicious aerial threats for decades. However, civilian drone technology is rapidly advancing and proliferating. Thus, the sophistication and volume of the threat require greater attention and resources that must be diverted and redistributed from other concerns. Focusing on the United States, where regulatory limitations on using commercial UAVs were recently relaxed, Maj Bryan A. Card expects that the malicious use of drones will expand. In offering active defense recommendations, he discusses the difficulties and tradeoffs of intercepting small UAVs. The drones’ small size and low altitude make them harder to detect on radar, the principal air traffic monitoring technology. Indeed, proper detection and disruption would require widely distributed and proactive measures. In an urban environment, Card argues that a dynamic defense model would require multiple trained operators staged throughout multiples avenues of approach. These would be high cost to both install and maintain. At the same time that VNSAs are benefiting from improved intelligence, mobility, and operational reach with drones, their targets are taxed with a higher volume and density of aerial threats. The combination of these characteristics elevates the threat of VNSA drones relative to many other platforms.

The Theaters

International Security

The most distant but obvious venues in which VNSAs exploit civilian drones are active war zones. Their versatility is apparent: individual actors using UAVs for propaganda, ISR, C2, target acquisition, and weaponized attacks. In 2011, in an early instance of reconnaissance with a drone, Libyan rebels obtained a commercial minidrone after being denied access to NATO aerial telemetry. Purchased from Aeryon Labs in Ottawa, a Canadian veteran tucked it into a backpack, flew to Malta, then boarded a tuna boat bound for the Libyan coast. The combatants quickly mastered the user-friendly platform, using it to identify and observe enemy positions during their rapid march from Misrata to Tripoli. With nightvision camera technology, they were able to continue and adapt under the cover of darkness. An Aeryon stakeholder remarked that “the rebels needed barely a day of training to use a technology that many national armies would love to acquire.” 

ISIL began using drones in 2013. Entirely grassroots, the group’s drone program depended on off-the-shelf technologies and do-it-yourself modifications. Yet it had the most robust drone infrastructure and intensive use of perhaps any VNSA. ISIL initially used UAVs solely for ISR. Though aerial imagery is available, much for free and some of higher accuracy for purchase, drone telemetry provides context-specific and time-sensitive intelligence on-demand. In March 2016, a drone drifted over a series of American and Iraqi bases in northern Iraq shortly before militants launched a Katyusha rocket into a populated zone of a US Marine base, killing a Soldier. The strike’s accuracy, called a golden shot, led some military officials to speculate that drone surveillance enabled it. Two months later, ISIL used drones for C2 (and propaganda) in a large-scale assault on Pershmerga positions north of Mosul, during which US Navy Seal Charles Keating IV was killed. Scholars also believe that UAVs facilitated the takeover of Raqqa, which would serve as the group’s headquarters and main stronghold, and the operation that led to the capture of a major oil refinery in Baiji, Iraq.

Used for passive purposes for two years before weaponization, ISIL first boobytrapped drones before successfully deploying aerial munitions. Two notable instances occurred at the end of 2016. The first involved three quadcopters rigged with explosives that killed two Kurdish fighters and seriously injured two French special forces soldiers upon detonation. In the second attack, a drone strapped with an explosive gained aerial access to a checkpoint, destroying some buildings. ISIL launched its first weaponized drone over Mosul in January 2017, when it dropped a bomb over an Iraqi outpost wounding and possibly killing a small group of soldiers. This bombing was followed by a flurry of similar attacks. The group’s propaganda channels became sated with imagery of combat drones, including models hovering over Western landmarks alongside calls for attacks abroad. ISIL drones had a high degree of accuracy and were often used in swarms, compelling allied forces to reposition, reorient, and sometimes retreat. Occasionally, rebels would wait for government forces to send up their drones so they would confuse ISIL drones with friendly materiel. According to a scholar at the Combating Terrorism Center at West Point, at the peak of its scale of operations in the spring of 2017, ISIL was conducting between 60–100 weaponized attacks per month. These attacks led to significant injuries that a surgeon in Mosul estimated to reach at least 10 per day. Such success absent state-sponsorship is a stark product of civilian drone advancement and accessibility.

The Syria civil war is another war zone rife with VNSA drone use. Alongside US Reapers, the Israeli Skylark, Chinese stealth tech, the Turkish Bayraktar, Russian Forposts, and multiple Iranian models flown by the Syrian regime, rebels are flying commercial, hobbyist, and even homemade drones. This number made the war the most drone-dense conflict to date. The state actors have a clear preponderance of airpower, yet rebels give them a run for their money with their recreational platforms. After a drone carrying explosives was downed in Idlib in August 2018, Russia admitted the frequency and success of VNSA weaponized drone attacks. A spokesperson from Russia’s Ministry of Defense insists that the drones, though improvised in appearance, are sophisticated and accurate.Earlier that year, Russia blamed the US for coordinating a drone swarm attack on its Hmeimim airbase after 13 primitive-looking drones coordinated their flight patterns to penetrate aerial defenses.This attack followed a successful weaponized attack at the same location, in which two soldiers were killed, and (allegedly, per Russia’s Kommersant newspaper) seven Russian aircraft were destroyed. Russian Federal Security Service chief Alexander Bortnikov remarked, “We believe that one of the pressing problems now is the growing danger of terrorists using unmanned aerial vehicles, both homespun and, even more dangerous, those manufactured professionally.”

Rebel-operated drones are just as prolific in conflicts outside the boundaries of hot wars. Indeed, UAVs extend those boundaries, increasing VNSAs’ logistical and lethal reach. While military forces on the front lines anticipate a certain tempo and timber of conflict, support units positioned in rear headquarters, logistical facilities, and routes in between are less prepared. In a striking example, Russian-backed Ukrainian separatists used drones to drop a thermite grenade on an arms depot, exploding approximately 70,000 tons of munitions estimated at $1B in damage.Houthi rebels have also reached softer, yet high-value targets with UAVs. In January 2019, fighters deployed drones in three salient attacks. At a military parade, a drone killed at least six soldiers (among them Yemen’s chief of military intelligence). It also injured several senior officials of the Arab coalition forces, including Yemen’s chief of staff, deputy chief of staff, and the provincial governor.A day later, Houthi rebels sent a kamikaze drone in pursuit of more Arab coalition officials in the Asir region, claiming that they attained more casualties. Then, an armed drone targeted a major general participating in UN peace talks. While it was intercepted en route, it did disrupt the meeting.The September 2019 drone attack on the Saudi Aramco oil facilities in Khurais and Abqaiq demonstrates that this newfound reach puts critical infrastructure in danger as well. Analysts estimate that the attack stunted 5 percent of the daily global oil supply and took several days to repair.

Violent nonstate actors are leveraging drones in conflicts, not only beyond war boundaries but churning below the threshold of war in insurgencies and lowintensity conflicts. As early as 2002, the Colombian Army seized nine drones from the Fuerzas Armadas Revolucionarias de Colombia during a camp raid.Like cartels around the globe, they now use these “narco-drones” to scout routes and exchanges, observe security measures, transport and deliver contraband, and for weaponization. Maute rebels and other Islamic State-affiliated insurgents in the Philippines use commercial drones to track and evade military forces. Boko Haram has begun using drones for surveillance, though authorities fear they will rapidly progress to weaponized platforms. The PKK began dabbling in armed drones in 2017. In their first attack in August of that year, the group used an off-theshelf drone modified with an explosive to attack a Turkish army outpost, wounding two Turkish soldiers. The PKK has increased its UAV use over time. In a twoweek period in March 2019, the group attempted a dozen drone attacks on Turkish forces, claiming some casualties. Spanning four continents, this shortlist well exhibits the versatility and impact of civilian drones for resource-constrained rebels.

National Security

The aerial threat is not limited to nations contending with war, insurgency, or low-intensity conflict. It presents a formidable national security problem, especially for nations normalized to civilian drones in the airspace like the US. Despite the US’s extensive investment to safeguard domestic assets and infrastructure after 9/11, many are easily bypassed by overflight.From our survey of intended, attempted, and successful drone attacks in multiple nations, it is clear that VNSAs have long been aware of and interested in this platform. As early as 1973, the Jewish Defense League deliberated the use of a “drone airplane” to bomb the Soviet Mission to the United Nations in New York. The first known attempt to weaponize a drone was in 1994 when Aum Shinrikyo ran failed trials to release sarin from a minicopter designed for aerosol crop spraying.A 2002 Security Management piece indicated that Osama bin Laden actively discussed using a drone rigged with an improvised explosive device to attack world leaders at the 2001 G8 Summit in Italy. However, the group opted for a more familiar technology platform in the end. In 2002, al-Qaeda aimed to deploy a drone filled with anthrax against the English House of Commons. The operator, Mozzam Begg, was intercepted before the plan unfolded and sent to Guantanamo.

Perhaps the most renowned case connected to al-Qaeda is that of Rezwan Ferdaus. In 2008, he revealed precise plans for rigging and exploding three drones in the US Capitol and Pentagon to Federal Bureau of Investigation (FBI) agents posing as al-Qaeda members, leading to his arrest and conviction.Don Rassler points out the technical hurdles he faced, including a long runway, payload limitations, and flight stability. An aeronautics expert remarked in a televised interview that “the idea of pushing a button and this thing diving into the Pentagon is kind of a joke, actually.” The commercial drone industry decimated all of these hurdles. Automatic vertical take-off and landing, autonomous stabilization, obstacle avoidance, dramatically higher payloads, moving target tracking, and Global Positioning System-guided pre-programmable autonomous flight are just a few features embedded in current-generation models. As for the last hurdle of detonation, there is ample evidence that VNSAs have overcome it. In one curious case, Venezuelan military defectors loaded two commercial drones with a kilogram of C-4 explosives each and detonated them near President Nicolás Maduro in a 2018 assassination attempt.

Israel, surrounded by terrorist groups seeking its destruction, has more experience than most nations with violent nonstate aerial threats. To its north is Hezbollah, sponsored, supplied, and funded by Iran. Hezbollah took a slow, steady pace in developing its UAV program, benefiting mostly from ISR. In 2012, the group sent an Ayub drone into Israeli territory via the Gaza Strip, making it 35 miles west into the Negev. Some reports suggested that the group conducted reconnaissance of a joint military exercise with the US, main airfields, ballistic missile sites, and the Dimona nuclear reactor. To Israel’s west in the Gaza Strip, Hamas has long had UAVs (also benefiting from Iran’s state sponsorship) and is avidly pursuing the development of its drone program because of the low cost and multiuse value. Israeli forces reinforced walls at the Iron Dome battery barracks in 2018 after several Hamas incursions into their airspace. This reinforcement was to guard against the possibility of a civilian drone explosive reaching the cluster of armed missiles that would generate a larger blast. Palestinian Islamic Jihad has also deployed drones, pulling off the first successful terrorist UAV bombing of the Israeli military, though the armored tanks targeted suffered minimal damage. Israel has also contended with drones straying from the Syria civil war, such as the one it shot down with a Patriot missile.

Iron Dome, Israel’s primary aerial defense system, is ineffective against small UAVs because it eliminates slow-moving targets from its acquisition algorithms to avoid becoming overtaxed. Adding their small size, lack of heat signature, the similarity of radar signature to stealth aircraft, low flight paths, and minimal noise, civilian drones present distinct detection and defense challenges. Once through defense measures, the military must mitigate the threat of enemy drones upon detection to avoid the potential of ISR gathering or violence. This mitigation stands whether the craft is an advanced stealth model or a jury-rigged child’s toy. Thus, despite Israel’s experience and qualitative military edge, it illustrates the challenge of tactical air control as drone use expands. As commercial drone technology proliferates, more VNSAs are joining the airspace, Israeli and otherwise, for affordable ISR, antagonism, and violent attack. This situation requires security providers to divert resources to mitigate the growing threat.

On a more focused scale, law enforcement agencies contend with similar challenges. Individuals, gangs, and cartels use civilian UAVs to augment crimes and disrupt police efforts. Some use drones for reconnaissance on potential burglary and robbery targets, to surveil law enforcement, or for witness intimidation. Smuggling efforts abound, even in prison. The most common items smuggled include drugs, tobacco, and weapons, although there is no lack of unusual contraband payloads from super glue to hacksaw blades. In a more creative use, one gang used drones to swarm, buzz, and flush out an FBI hostage rescue team attempting a raid at an undisclosed location in Colorado. The increasingly broad and diverse range of airborne actors led the International Criminal Police Organization to initiate a new unit solely to monitor criminal drone activity in 2018. Though not new in concept, the scale and variety of VNSA commercial drone use will increasingly tax the resources of local, national, and international security providers.

Aviation Security

Another theater threatened by malicious drone use is civilian aviation. Hobbyist drones can potentially disrupt commercial aircraft, either by an attack on airfields, impact in flight, or catalyzing engine failure. Certainly, commercial planes are at risk from a number of sources—pilot error, equipment malfunctions, fellow planes, birds, not to mention the ground. VNSA drones are distinct from these, though, in that they actively aim to undermine flight safety. Terrorists recognized the opportunity to disrupt aviation using commercial UAVs early in their development. According to German intelligence, al-Qaeda discussed plans to attack a passenger plane with a model airplane as early as 2002. As commercial technologies have improved, similar plans have become more frequent. In a single month in 2016, social media featured numerous jihadist calls to use drones to carry explosives to attack passenger planes parked on airfields, suggestions on the mass production of weaponized drones, and varied discussions on how to carry out terror attacks on airplanes with UAVs. In this same year Spain’s Centre against Terrorism and Organised Crime cited drones as the biggest malicious threat to civil aviation.

Knowing the magnitude of potential damage and casualties, aviation security specialists, pilots, and air traffic control personnel are quick to react to drone sightings. They frequently cause flight diversions, delays, and cancellations, and at times the shutdown of entire airports. A Michigan news station reports 36 instances of drone interference with airplanes. In Ohio, drones nearly collided with planes 117 times over a five-year observation period. The UK Airprox Board reports a monthly average of 15 “airprox incidents” in 2017, 11 in 2018, and 12 in 2019. In 2018, the nation reported the closest near-miss incident in their history, a drone avoiding impact with the engine of a commercial plane carrying 264 passengers by 10 feet. Similarly, in 2019, a drone came within 20 feet of smashing into a jet carrying 300 passengers in Abu Dhabi. In-flight over Mexico, a drone reportedly did collide with the nose of a Boeing 737 passenger plane, causing it to perform an emergency landing in Tijuana and causing “considerable damage.”Given the imminence, liability, and profit loss involved, the aviation industry has long been aware of this threat. As civilian drones advance and proliferate, however, the threat could become more difficult to mitigate.


In response to VNSAs increasingly joining the range of actors leveraging airpower’s attributes, we offer three considerations. First, resorting to antidrone technologies is commonsense. Any such programs, however, must consider cost proportionality and sustainability. Shooting down hobbyist drones with Patriot missiles and other traditional firepower addresses neither. Jamming signals to disrupt a potentially threatening drone, which could also jam other civil functions, such as industrial, medical, Bluetooth, mobile, and wireless internet bands, might not be proportionate in many contexts. Constant, extensive, or intensive systems might not be sustainable. Since commercial drones are affordable, reusable, and replaceable, their countermeasures must be similarly feasible.

Second, in some cases, it might be more valuable for state powers to shift the focus from combating battle-ready drones in the skies to disrupting logistical supply chains and degrading terrorist drone workshops before the drones become operational. Granted, one reason that commercial UAVs are attractive to VNSAs is that they are accessible and unregulated, making supply chain disruption difficult. However, prolific users of weaponized drones tend to have streamlined drone programs, including manufacturing and modification centers. For example, when allied troops recaptured Ramadi from ISIL in 2015, they found a drone manufacturing and modification workshop. In another instance, following several attacks over many months, Russian forces operating out of Hmeimim airbase in Syria discovered a drone workshop in a cave system nearby. 

Finally, given the variety of theaters in which VNSAs are using drones, we encourage contextual responses. Law enforcement solutions might be more embedded in the local landscape, while military solutions will need to be more mobile. Protective measures in hot war zones might look different than those in low-intensity conflicts or counterinsurgencies. Successful antidrone systems will vary across urban, forested, desert, mountainous, or littoral terrains. Some defense apparatuses must be broadly distributed, while some can isolate strategic corridors or zones of flight. Some antidrone programs should remain exclusive to a single security provider, while others might operate best shared jointly across allies. The only universal response we promote is critical attention to the phenomenon of increasing VNSA drone use. It is likely here to stay.

Source: Air and Space Power Journal by Kerry Chávez / Dr Ori Swed





Leave a Comment