CISA Critical Infrastructure Sector

Drone threats to communications infrastructure

Towers, backhaul links and network facilities sit at the intersection of physical and radio frequency risk. A drone over a tower site can carry a camera, or it can carry nothing at all and still represent an unresolved question about who is watching your infrastructure and why. Both cases need a documented answer.

Where The Exposure Is

Four things that make this sector different.

UNSTAFFED SITES

Most towers and remote network facilities have no person present day to day. An overflight there produces no witness and, without detection, no record.

PHYSICAL AND RF EXPOSURE

A drone near a tower can threaten equipment physically or interfere with the radio environment around it. Either failure mode can produce a reportable network outage.

DISPERSED PORTFOLIOS

A single carrier or operator can hold thousands of sites across a footprint. Security posture is rarely uniform, and exposure follows the outliers, not the average site.

NO PHYSICAL SECURITY STANDARD

There is no mandatory federal physical security standard for towers, which means the posture at any given site reflects the operator’s own judgment rather than a floor set by regulation.

Regulatory Context

AN OUTAGE-REPORTING RULE, NOT A PHYSICAL SECURITY RULE

The FCC’s network outage reporting rule (47 CFR Part 4) requires wireline, wireless, cable, satellite and interconnected VoIP providers to report significant service disruptions. An outage of at least 30 minutes that reaches 900,000 user-minutes, or that affects 911, 988 or an airport, requires notice within 120 minutes, an initial report within 72 hours and a final report within 30 days. The rule governs reporting, not the physical security of tower sites, and it does not mention drones.

47 U.S.C. 333 prohibits willful or malicious interference with licensed or federal radio communications. That prohibition is one of the reasons private jamming of a drone’s control link is not an available option for a communications operator, regardless of the perceived threat.

There is no mandatory FCC physical security standard specific to towers. Where a DVRA applies: it maps drone scenarios, such as tampering with or striking tower-mounted equipment, that could trigger a reportable Part 4 outage. This is resilience work built around an existing reporting obligation, not a standard the FCC requires operators to meet.

How An Engagement Applies Here

The same four pillars, scoped to this environment.

01 OPERATIONSView pillarManaged detection and monitoring across tower and network facility sites, with intelligence briefings on activity observed near critical nodes.

02 ASSESSMENTSView pillarA DVRA establishing which sites in a portfolio carry the most exposure, and what a drone incident there could realistically reach.

03 RESPONSEView pillarMitigation strategy and TTP development, tabletop exercises run against an outage-triggering scenario, and forensics after an incident.

04 TRAININGView pillarCertification paths so network operations and field personnel retain detection and reporting competency in house.

Common questions

Has ClearPoint worked with organizations in this sector?

This page describes how our method applies to the environment, not a client list. ClearPoint does not publish client or engagement records.

Does a drone incident near a tower have to be reported to the FCC?

Only if it causes a qualifying service disruption under 47 CFR Part 4, meaning at least 30 minutes of outage reaching 900,000 user-minutes or affecting 911, 988 or an airport. The rule governs the outage report itself, not the drone incident, and a DVRA is designed to help you understand which scenarios at which sites could actually trigger that reporting threshold.

What does an engagement here usually start with?

A DVRA. It establishes which sites in a portfolio carry the most exposure and what detection or procedure gap exists at each.

Can you stop a drone over our facility?

No. In the United States, mitigating a drone is limited to federal agencies with statutory authority and, since July 2026, to state and local law enforcement and correctional agencies certified under the SAFER SKIES Act. ClearPoint does not mitigate. ClearPoint detects, tracks, assesses, documents, trains and coordinates with the agencies that hold that authority.

Can you jam a drone’s control signal near our tower?

No. Jamming a radio signal violates federal communications law, and ClearPoint does not perform mitigation of any kind. Our work is detection, assessment, documentation and coordination with the agencies that hold mitigation authority.

CAPABILITYDVRAThe five-stage assessment method and what each stage leaves behind. PILLAR 02AssessmentsRed teaming, tabletop exercises, threat and technology briefings. SECTORSAll 16 CISA sectorsWhere else this applies, and what exposure looks like there.