Category Archives: Security

Drone Countermeasures Against Laser Weapons

I’ve been getting involved in a counter-drone market for many years now, including time spent in government offices with operators discussing the “latest” technology advances. Not everyone seems excited to hear about details in this area of security research.

One thing that regularly has come up is whether the venerable laser weapons are yet effective. I have to use the term venerable because the US Air Force itself will tell you they’ve been experimenting with lasers shooting down drones since the early 1970s (according to AFD-070404-025).

…1972 when technicians fired a ground­ based 100 kilowatt CO2 laser that propagated at 10.6 microns against a variety of stationary targets. The tests went so well the project elevated to firing the laser at a moving airborne target. On November 13, 1973, the laser was used against a 12 ­foot­ long Northrop MQM­33B
radio controlled aerial target, a drone, in an attempt to knock it out of the air. Indeed, the drone did drop, but not precisely as planned.

Northrop (Radioplane) OQ-19/KD2R/MQM-33 drone was produced for over four decades

In theory the laser tracks the target drone and then emits hot light to melt inexpensive plastic. Popular Mechanics has just posted a good example of this theory being turned into real-world application, called “This Is How a Laser Weapon Torches Drones Out of the Sky“.

Unfortunately the story was written around “a simple promotional video for Rafael’s Drone Dome, an anti-drone laser weapon”, making it a bit of PR extending the PR released by the manufacturer themselves.

Instead of taking the video at face value, better analysis is in order.

Here are a few thoughts on why perhaps it’s not such a bright idea (pun intended) for journalists to uncritically post a laser vendor’s demonstration.

1) Light reflection. Mirrors are a simple and logical countermeasure. As Dr. Seuss might put it, any chrome drone would bounce a drone dome. The dissipation of energy, to be fair, isn’t child’s play so the mirrors have problems to tackle. But an Office of Navy Research is definitely proving the point with their work on Counter Directed Energy Weapons. More to the point, the Air Force says the latest reflective anti-heat technology developed for energy efficient buildings (windows and roofs) is something that could be applied to all their weapons systems.

2) Dissipation of energy. In a famous case in Mexico, a liquid-cooled door greatly slowed police battering rams. The point here really is to push energy into heat sinks or disposable parts to slow absorption. Again, energy efficient buildings are developing things like phase change materials to absorb energy that easily could be applied to drones. Slowing the energy effectiveness on the drones could mean a moderately-sized swarm might easily overwhelm or avoid laser weapons.

3) Obfuscation. Both above technologies have very useful civilian applications, and thus are likely to improve faster than any expensive laser weapon can innovate. There’s also a more traditional countermeasure, which is to foul the environment a laser has to pass through. Drones could generate a synthetic cloud or fog. A swarm of drones could even create a blanket or corridor that renders laser weapons ineffective. NASA a couple years ago described a version of this working.

10 canisters about the size of a soft drink can will be deployed in the air, 6 to 12 miles away from the 670-pound main payload. The canisters will deploy between 4 and 5.5 minutes after launch forming blue-green and red artificial clouds.

Again slowing down the laser weapon is all that is needed. As one counter-counter-drone researcher put it to me “the glitter bomb is a zero cost defense”.

4) Counterattack. Lasers depend on being able to see, and be seen, so drones can fire lasers back at the source in order to blind the tracking systems or disrupt the light waves.

There are four devastating examples and more probably exist. In every one it’s economics, a matter of having inexpensive and rapidly iterating countermeasures that bypass the extremely expensive and slow-developing laser weapons.

Let me be clear, laser weapons are effective against operations that are not explicitly trying to build countermeasures to laser weapons. There is still a need for laser weapons. However, journalists do us no favors by promoting vendor PR and repeating nonsense like “100% effective”, given we have nearly 50 years of evidence how and why laser weapons fail.

Interactive Map of U.S. Supply-Chain Vulnerabilities

Years ago I wrote about the secret history that lurks behind a famous American dessert.

Nobody else, at least to my knowledge, has been thinking and writing about the supply-chain vulnerability management required for America to promote itself as home of the banana split.

Now there’s an interactive map of supply-chain vulnerabilities, which seems like it would be ideal for speeding up research and illustrating stories like the one I wrote.

FEW-View™ is an online educational tool that helps U.S. residents and community leaders visualize their supply chains with an emphasis on food, energy, and water. This tool lets you see the hidden connections and benchmark your supply chain’s sustainability, security, and resilience.

FEW-View™ is developed by scientists at Northern Arizona University and at the Decision Theater® at Arizona State University. FEW-View™ is an initiative of the FEWSION™ project, a collaboration between scientists at over a dozen universities (https://fewsion.us/team/).

FEWSION™ was founded in 2016 by a grant from the INFEWS basic research program of the National Science Foundation (NSF) and the U.S. Department of Agriculture (USDA). The opinions expressed are those of the researchers, and not necessarily the funding agencies.

However, there are two problems I see already with the map. First, it doesn’t go backward in time. The illustrations would be far more useful if I could pivot through 1880 to 1980. Second, the interactive maps allow you to break out a booze category but I have yet to find a way to filter on bananas and pineapples let alone ingredients for three flavors of ice cream.

Blade Runner 2020: Are We There Yet?

First a recent DARPA video shows how a swarm of drones would be carrying out an urban exercise:

Second, special operations describes their “future fights” training as assessing trustworthiness of partners in the field:

..instructors hear a gunshot echo in the woods. An extrajudicial killing ‘is obviously not ideal,’ one Special Forces instructor said.

Add these two together and you get special operators dropping into urban areas to identify and ultimately eliminate untrustworthy partners, which obviously means drones in the near future.

That pretty much sounds like the thesis of Blade Runner, which is finding presence of machines that lack empathy and then eliminating them. The tough question being, as the instructor said, is an assessment of imminent harm judicial or scientific enough to warrant hitting the off button?

Add Threat and Business Data to Vulnerabilities Using the Latest Open Source Risk Tools

Kenna’s open source Exploit Prediction Scoring System Calculator (EPSS) threat calculator is a significant advance in risk theory beyond using the Common Vulnerability Scoring System (CVSS) on its own

For example, CVE-2019-0708 (Remote Desktop Services Remote Code Execution Vulnerability: May 14, 2019) has a EPSS threat score of 95.2% being exploited in the next 12 months, with a CVSS score of 9.8 (Critical).

That might be an obvious outcome, but it hopefully illustrates some of the importance in adding threat data to the vulnerability remediation timeline.

The real trick is finding CVSS that are low with EPSS that are high because that indicates a risk perception imbalance that quickly can lead to disaster.

On top of this advancement, consider also the riskquant tool recently released that does basic likelihood/severity mapping that probably has been debated in every disaster recovery planning audit meeting for the last 20 years let alone NIST SP 800-30.

…annualized loss is the mean magnitude averaged over the expected interval between events, which is roughly the inverse of the frequency (e.g. a frequency of 0.1 implies an event about every 10 years)…

Both tools are meant to help move from point scores of severity to trends of probabilistic likelihood and should be given a look sometime in the near future.