Disclosure: Atlas Special Projects prepared a public comment on the rule discussed below on behalf of a counter-UAS manufacturer. The argument here is my own, and it applies to a category of technology rather than to any company's product.
Welcome to The Iron Triangle, the Cipher Brief column serving Procurement Officers tasked with buying the future, Investors funding the next generation of defense technology, and the Policy Wonks analyzing its impact on the global order.
During the week of March 9, drones came over Barksdale Air Force Base in waves. Barksdale is the home of the 2nd Bomb Wing, one of the places this country keeps its nuclear-capable bombers. The base issued a shelter-in-place order and stopped flight-line operations, and the Air Force has declined to say precisely how many aircraft were up there or who was flying them. NORTHCOM's counter-drone fly-away kit, the good one, the one that worked over a strategic installation in the opening hours of Operation Epic Fury on February 28, was somewhere else. There is only one of them.
Then General Gregory Guillot told Congress the number that should have ended the conversation about whether we have this handled. "About a quarter of the ones that we detect, we're able to defeat." He offered it as good news, and by the standard of the previous year he was right: in 2025, he said, "almost every one that was detected was not defeated."
Hold that in your head. The federal government with every authority Congress can write, the entire electromagnetic spectrum at its disposal, and a defense budget larger than the next nine countries combined, stops one drone in four over its own bomber bases.
Now we are handing the same problem to a sheriff's department in Talladega, and we have written them a rule that is worse.
A Rule That Anticipates Everything Except the Answer
On July 6, the Departments of Justice and Homeland Security published the interim final rule implementing the SAFER SKIES Act, effective July 1, and for the first time extended real counter-drone authority to state, local, tribal, and territorial law enforcement, and, critically, to correctional agencies. This is overdue, it was built fast, and the people who wrote it deserve credit for standing up a certification and oversight architecture on a compressed timeline.
Then you get to the Authorized Technologies List, which is the part that decides what a certified agency may actually field. The Departments expect the initial list to contain three categories: radio-frequency detection with command-and-control signal interception, RF disruption (broadband and protocol-specific jamming), and RF protocol manipulation, meaning command injection and cyber takeover. All three are radio-frequency categories. There is no fourth.
This would be an unremarkable sequencing decision except that the rest of the rule plainly contemplates bringing an aircraft down by physical means. The statute authorizes certified agencies to use reasonable force to "disable, damage, or destroy" an unmanned aircraft. The rule requires air-traffic notification for mitigation that emits no radio frequency, and the preamble explains why in language that leaves nothing to interpretation: such an action can affect the airspace "for example by bringing an unmanned aircraft down or creating falling debris." The rule requires Mitigation Certification for personnel who physically intercept a drone in flight.
So the rule trains an agency to do it. Certifies the officer to do it. Writes the falling-debris notification procedure for when they do it. And then hands them a list with nothing on it they can do it with. Plainly spoken, the rule does not include kinetic interceptors, something that knocks a drone out of the sky.
That is what happens when a list gets populated by whatever already had the deepest federal deployment history, which is exactly what the Departments said they were doing. The RF categories had the paperwork. So the RF categories got the boxes. The list has nothing to do with what works. It is a fossil record of what has already been bought.
Three Categories, One Point of Failure
Here is why this is a safety problem and not a paperwork problem. The three listed categories are functionally distinct and they share a single dependency: every one of them requires the target aircraft to present an exploitable radio link. Where there is no link, interception has nothing to intercept, jamming has nothing to jam, and cyber takeover has no protocol to take over. They do not degrade independently. They fail together, at the same instant, against the same threats.
Three classes of aircraft now routinely present no such link. A drone flying a stored waypoint route with its control link severed emits nothing and listens to nothing; this is a checkbox on consumer airframes. A protocol-hardened or custom-built airframe falls outside the signature libraries that detection-and-takeover systems depend on. And then there is fiber optic, which is the one that should be keeping planners awake. They manage control and video via physical filament. There is no radio link at all. Fiber optic drones are immune to jamming as a matter of physics rather than engineering. Russia is turning out more than fifty thousand fiber-optic FPV drones a month at a single facility in Veliky Novgorod. The technique defeated RF countermeasures at Kharkiv. It defeated them over Victory Base Complex in Baghdad, where there was no visible intercept attempt at all.
None of this is exotic. It is three years old, it is cheap, and it is documented in open sources that any competent adversary reads on the same afternoon you do.
An agency limited to the three RF categories is superbly equipped against a careless hobbyist with a stock quadcopter and defenseless against anyone who has been paying attention. That is precisely the inverse of the risk profile the rule exists to address.
The Recent Events Are Not Ambiguous
On June 24, just twelve days before the rule was published, the Justice Department indicted twelve defendants in what it called the largest federal prosecution to date involving coordinated drone operations to smuggle contraband into prisons. Ten federal facilities across eight states. Thirty-eight documented drops using six aircraft, running from September 2023 through May 2026. Methamphetamine, K-2, Suboxone, cell phones, tobacco, and saw blades.
Two and a half years of flights. Thirty-eight of them are documented. That is not a hobbyist wandering into restricted airspace. That is a logistics operation with route planning, aircraft attrition, and a customer base. Organizations at that level of sophistication adapt to countermeasures. The adaptation most cheaply available to them is the one the initial Technologies List cannot answer.
Compare the coverage. Five days later a JetBlue crew reported striking a drone on approach to JFK, and it led the news for a week before a preliminary investigation found no physical evidence that it happened at all. The collision that may have been nothing got the cameras. The thirty-eight drops that certainly happened got a press release from the Middle District of Georgia.
The Part That Should Embarrass Us
Now for the contrast that makes this a column instead of a comment.
On January 28, Brigadier General Matt Ross, who directs Joint Inter-Agency Task Force 401, told reporters: "I see us using low-collateral kinetic interceptors at all installations in the homeland." The Deputy Secretary of Defense had directed JIATF-401 to ensure kinetic capability at every location. Two days later the task force awarded $5.2 million for the Bumblebee V2, a kinetic interceptor, with deliveries beginning in March. Asked about squeamishness over kinetic engagement inside the United States, Ross said he "fundamentally disagrees."
Same airspace. Same threat. Same country, in the same calendar year. The Department of War calls low-collateral kinetic interception essential and is buying it for every installation in the homeland. The Departments of Justice and Homeland Security published a list on which that category does not exist.
What Each Corner of the Triangle Should Take From This
For the Procurement Officer, understand what you are budgeting against. You can be accredited, certified, trained, and funded, and still have nothing to buy, because the box your requirement lives in has not been created. The rule as published does not tell you plainly that kinetic capability is unavailable to you. State and local agencies are writing fiscal-year plans and grant subaward requests against it right now, and some of them are going to buy capability they are not authorized to employ.
For the Investor, this is the diligence question you are not asking. You have been asking whether the technology works and whether there is a customer. Start asking a third question: what category does this go in, and does that category exist yet? A company can be technically excellent, combat-proven, and commercially validated, and still be unsellable because a list has no line for it. Listing risk is not a footnote in the regulatory section of the deck. In this sector it is the whole thesis, and it is currently unpriced.
For the Policy Wonk, notice what just happened to the locus of policy. Congress debated the SAFER SKIES Act in public. The interim final rule went through interagency review and took comment. But the Authorized Technologies List, the instrument that actually determines what a certified American police department may deploy against a drone over a school, is an administrative artifact updated through a coordination portal. No one voted on it. Most people affected by it do not know it exists.
I have spent years watching good capability lose to bad process, and I thought I had seen the full catalogue. I had not. The Valley of Death I have been writing about is a money problem: you have the technology, you cannot get the contract. This is something else. This is a company that has the technology, the customer, the certification, the training pipeline, and the federal deployment history, and cannot sell, because the taxonomy has no word for what it built. Call them the Unlisted. They are the Forgotten Bench's stranger cousin, and they lose more quietly, because there is no rejection letter. There is just a list that does not mention them.
The fix is small and it is already scheduled. The Departments said they would run a sixty-day sprint to revise the list after publication. Add a fourth category, low-collateral kinetic interception, defined narrowly enough to exclude firearms, unguided ballistic means, directed energy, and anything heavy enough to be its own hazard. Write objective listing criteria the way the RF categories already have them: bounded interceptor mass, bounded terminal energy, demonstrated fail-safe behavior on loss of lock, a modeled and test-validated debris footprint, a declared engagement envelope. Then say plainly, in one sentence, that until such a category exists, kinetic mitigation is unavailable so that nobody spends a grant on a capability they cannot lawfully employ.
The Risk
I am not going to pretend this one is free, because it is not, and the people who will be nervous about it are right to be. Radio-frequency mitigation that fails harmlessly drops a link. Kinetic mitigation that fails drops an object, and it drops it over a stadium concourse, a prison yard at count time, an interstate at rush hour. The rule's own falling-debris notification requirement exists because somebody thought that through, and a two-kilogram interceptor over a crowd is not a spreadsheet exercise. Widening this list carelessly buys us a very bad Tuesday.
There is a second risk, and I have written this column before from the other direction. A category written narrowly enough becomes a moat for whoever helped write it, which is how well-intended technical criteria turn into incumbency by another name. That is the ITAR story wearing a domestic uniform, and anyone advocating for a new category, including me, should be watched for it.
And a third: certification is not proficiency. A deputy with forty hours of classroom time and a kinetic interceptor is a genuinely different risk than an operator who has done it a thousand times. Recurrency has to be tied to the effector an agency actually fields, not to one undifferentiated certificate, because competence with a jammer transfers to a kinetic interceptor exactly not at all.
None of that argues for keeping the category empty. It argues for writing it carefully, on a clock, with real criteria, which is a harder job than leaving the box blank, and the reason the box is blank.
We have built a system in which the most consequential procurement decision in American counter-drone policy is not made by a program office, a contracting officer, or a member of Congress. It is made by whoever maintains a list. Comments on the rule close on September 4. After that, the question stops being what we should have listed and becomes what we have to explain. The honest version of that question is this: when a drone that does not answer a radio comes over the wire at a federal prison, and the certified, trained, funded officer standing under it has nothing on the list to use, whose signature is on that?
Read more national security insights from experienced experts exclusively in The Cipher Brief.
