Suzanne Gallagher takes a look at the use of unmanned aerial vehicles (commonly known as drones) in a law enforcement context and maps out the current regulatory framework.

Up, Up and Away

The past decade has seen the swift adoption of drones as a tool in the armoury of the police and other law enforcement agencies. Last year, the campaign group Drone Watch gathered information on police usage of drones in the UK. The responses to Freedom of Information requests sent to 48 police forces revealed the true extent of this phenomenon. 33 regional forces now directly own and use drones. Three others said they operate drones owned by other police or fire services. A number of police forces indicated they are using drones for covert surveillance operations. The Metropolitan Police Service (MPS) has over 20 drones in operation.

12 police forces confirmed that they deploy drones in operations involving protests and public order. Lincolnshire Police reported that drones were used to monitor a Black Lives Matter protest and a protest at an immigration centre.

Other enforcement agencies are also adopting this technology. In a recent blogpost on the topic, the Environment Agency (EA) reported on its use of drones to assist with regulatory, compliance and enforcement work. The EA outlined the benefits of adopting the technology; drones offer EA inspectors unique perspectives, making otherwise inaccessible areas accessible. They have been deployed with enthusiasm by environmental crime teams to gather intelligence about illegal waste sites, avoiding the need for physical presence on site when collecting evidence used to bring criminal proceedings.

Flying High

Recently, the National Police Air Service (NPAS) has indicated its intention to take the application of this technology up a gear. NPAS is a police aviation service that provides centralised air support to police forces in England and Wales. It recently published a market engagement survey to determine what technical functionality currently exists for beyond visual line of sight (BVLOS) drones with infrared capability.

The market engagement survey asks for details of BVLOS drones that can operate for a minimum of 4 hours up to 50 kilometres away from the base station. NPAS is interested in obtaining information on drones capable of capturing facial features and clothing details for individuals, as well as make, model, colour and registration numbers for vehicles. It was reported in February 2022 that the MPS, West Midlands Police, Thames Valley Police and Norfolk Constabulary are participating in an NPAS research project to pilot drones up to 30 kilometres away. Devices could be controlled from police headquarters or other remote base stations.

Partial Vacuum

While this technology has been swiftly embraced, there is no dedicated legal framework governing its use in a law enforcement context. This contrasts with the US where, although the position varies between state to state, regulation governing the use of drones in policing has advanced significantly. At least 18 states have introduced laws that require the police to obtain a warrant before take-off is permitted.

Back in this jurisdiction, the Civil Aviation Authority (CAA) regulates the use of drones. Drone operators must pass the national CAA accredited qualification, and special CAA permissions are required for commercial drone operation. Permission allows the operator to fly the drones in congested areas, and permits flying over people and premises, provided other conditions and minimum separation distances are met. Drones must be supervised by a human operator – autonomous flight is not permitted.

Drone operators may wish to consider the Surveillance Camera Commissioner (SCC) self-assessment tool to ensure that their use of drones complies with the Surveillance Camera Code of Practice (the Code). The SCC has also developed a certification process which is available to any organisation that operates surveillance cameras in public spaces. Under the Code, surveillance cameras must always be for a specified purpose, pursue a legitimate aim and be necessary to meet an identified, pressing need. Images and information should be stored no longer than is strictly required for the stated purpose of the surveillance camera system, and such images and information should be deleted once the specified purpose has been discharged.

Data protection legislation also provides safeguards. Part 3 of the Data Protection Act 2018 (DPA) regulates the processing of personal data for law enforcement purposes. There are six data protection principles which must be complied with.

Law enforcement processing must be lawful and fair (the first principle), specified, explicit and legitimate (the second principle), adequate, relevant and not excessive (the third principle), accurate and up to date (the fourth principle). The data must be kept for no longer than is necessary (the fifth principle) and must be kept securely (the sixth principle).

In July 2021, the Information Commissioner’s Office (ICO) published a report on police data processing. The report found that more than 75% of police forces audited either did not have a documented record of all processing activities in line with requirements set out in UK GDPR and DPA 2018, or where one existed it was incomplete. The lawful bases for processing had not been determined in all cases. There was a lack of evidence within some forces that staff had received, read, and understood changes to key data protection policies and procedures.

The ICO has its own code of practice for surveillance cameras and personal information for organisations. This guidance states that drone operators must provide strong justification for their use, and a robust privacy impact statement. Drone operators must adopt innovative ways of tackling the problem of individuals not knowing they are being recorded with transparency in mind; they must ensure individuals are aware drone surveillance is in operation.

The ICO has not published any specific guidance on the use of this technology in a law enforcement context, nor has it reported any enforcement action against a law enforcement agency related to drone-use.

Back Down to Earth

The standards put in place by the CAA, SCC and the ICO may be considered insufficient by many. The lack of robust regulatory oversight has consequences. Department for Transport’s Air Accident Investigation Branch (AAIB) published a report on the Da Jiang Innovations (DJI) Matrice series 200 drones, a surveillance drone commonly used by police and emergency services. The drone is reported to malfunction without warning when exposed to moisture, including rain.

A DJI Matrice 210 drone being operated by officers from Norfolk Constabulary crashed, giving the pilot only a second’s warning before falling from the sky. The AAIB report said: “The pilot had checked the weather and although very light rain was forecast, it was considered that the conditions were suitable as they were within the manufacturer’s parameters.” In March 2019, a Leicestershire Police drone (another DJI Matrice 210 model) crashed while being flown in the rain about 300 feet above a public road in Leicester City.

In December 2021, AAIB reported on an April 2021 accident involving a Thames Valley Police drone. The operator lost control and the drone was found the following day in a playground five kilometres away. The investigation found that the operator of the drone had not met the police’s own training requirements. At the time of the accident, he had approximately 3.5 total flight hours experience.

Flying Dragon

The drone manufacturer DJI, based in Shenzhen, China, is facing calls for sanctions in the US amid concerns that centre on its data collection capabilities.

In May 2019, the U.S. Department of Homeland Security warned of the risks to company data from drones. Contemporaneous reporting suggested American businesses were warned about the hazards of using drones manufactured or sold by companies “operating under the control or influence of a foreign authoritarian state”, since the camera- and sensor-laden devices are “capable of collecting and transferring potentially revealing data about their operations and the individuals and entities operating them”. Chinese manufactured drones were deemed to be a “potential risk to an organization’s information,” as they “contain components that can compromise your data and share your information on a server accessed beyond the company itself.”

In 2018, the US Department of Defense (DOD) issued a ban on the purchase and use of all commercial off-the-shelf drones, regardless of manufacturer, due to cybersecurity concerns. In December 2019, the US Congress prohibited the purchase and use of Chinese manufactured drones by DOD. In 2020, DJI was added to the US Commerce Department’s Entity List, restricting its access to US components. The DOD published a statement in July 2021 stating that systems produced by DJI “pose potential threats to national security”. In December 2021, DJI was put on an investment exclusion list, banning US citizens and companies from buying or selling shares in DJI.

What’s Next?

Law enforcement agencies in the UK are caught between ever-increasing expectations of their ability to investigate prevent and prosecute crime and stretched resources to achieve those laudable ends . It is against this backdrop that they are examining how new technology can help them perform their duties to the standards demanded by the public and politicians. Evidence gleaned by drone technology has already proven to be vital in a range of police activities, including searches for missing persons and dangerous offenders. However, the pace of change presents risks.

Adopting this technology too quickly may have unforeseen consequences for civil liberties, data protection and national security.  We live in an age where terabytes of material can be stored and processed electronically on remote servers in unknown jurisdictions. As technological advances expand the possibilities available to law enforcement, it is vital that legislation governing its use keeps pace if public trust is to be maintained and if, in turn, the highly-prized model of policing by consent is to survive into the future.