The FAA Built a Drone Shield With No Shield: Inside the Enforcement Gap in Section 2209

The FAA has finally written the rule that drone experts have been waiting nearly a decade for. It says no.

The agency published a proposed rulemaking on May 6 establishing a process for critical infrastructure sites — power plants, water treatment facilities, nuclear reactors, and 13 other sectors — to request no-drone flight zones above their property. The underlying authority, Section 2209 of the FAA Extension, Safety, and Security Act of 2016, was passed under the Obama administration. The implementing rule arrived eight years late.

But the rule's own text is its own punchline. It explicitly forbids the only things that would make the designation mean anything: no geo-fencing hardware, no signal jamming, no spoofing equipment, no drone interception. The UAFR — Unmanned Aircraft Flight Restriction — creates a legal no-trespassing sign for airspace. It does not build a fence.

"The UAFR would not independently create a physical boundary or authorize operators or proprietors of the fixed site facility to establish a geo-fence or other electromagnetic boundary to prevent unauthorized access," the Federal Register filing reads.

What happens when a drone ignores the sign? The rule does not say. The answer lives in a different building.

The Safer Skies Act, now codified through the NDAA 2026, authorizes trained state, local, tribal, and territorial law enforcement to detect, track, and in some cases disable drones posing a credible threat at covered venues. The FAA's DETER program — Drone Expedited and Targeted Enforcement Response — launched April 16, 2026 as a parallel track to speed up enforcement. Both are real authorities. Both are separate from Section 2209. And neither one is in this rule.

The practical effect is a gap between naming and enforcement that has no obvious closer. A chemical plant in Texas can file a petition, get designated, and post the restriction. When a drone shows up anyway, the plant's security team cannot touch it. They call law enforcement. Law enforcement shows up, if they can, and figures out what tool to use. The FAA's rule is the part that happened in a document. The rest requires people to coordinate across agencies, training programs, and jurisdictions that have never been written into one flowchart.

"The functions of the UAFR would be to create a legal designation informing users not to access the airspace and allow regulators and law enforcement to enforce the restriction," Unmanned Airspace reported. That "and" does considerable lifting. Regulators can act if they have the tools. Law enforcement can act if they have the training. Both are conditional.

The gap matters because Section 2209 was supposed to solve a specific problem: critical infrastructure operators had no legal way to push back against unauthorized drones, and the FAA had no process to designate protected airspace. What the proposed rule delivers instead is a property-rights arrangement with no enforcement mechanism attached. The designation creates a right. Enforcement of that right requires a second chain of authority that the rule deliberately does not provide.

That structure is not accidental, according to some legal scholars who study airspace rights. Federal aviation law has long grappled with the question of who owns the airspace above private land — a question the Supreme Court has not fully resolved. By creating a petition process for airspace restrictions without authorizing physical countermeasures, the FAA is making a legal claim on behalf of critical infrastructure operators without triggering the property-rights complications that would come with actual exclusive-use zones. Whether that ambiguity is a feature or a bug depends on who you ask.

The rule does establish a two-tier structure for the designations themselves. A Standard UAFR requires applicants to demonstrate FAA safety and security compliance, a process roughly analogous to getting a building permit for the airspace above your fence line. A Special UAFR requires both FAA and a federal agency sign-off, making it harder to obtain but more durable once granted. Restrictions can persist for up to five years under the Special track, effectively giving a facility a long-term airspace easement over private land below.

Sixteen sectors qualify under the proposed rule: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors and materials and waste, transportation systems, and water and wastewater. That list covers most of what the phrase "critical infrastructure" actually means in practice.

Transportation Secretary Sean P. Duffy, who unveiled the proposed rule at an FAA event last year, framed it as restoring airspace sovereignty. "Restoring airspace sovereignty in America means protecting sensitive locations from aerial threats while providing clear guidance to drone pilots so they can operate with confidence," his office said in a statement.

The guidance exists. The protection does not.

There is a counterargument worth taking seriously. Drone operators are already required to broadcast Remote ID — an electronic signature that identifies the aircraft and its operator — under FAA rules that took effect in 2024. Post-hoc enforcement through Remote ID data, combined with existing laws against reckless flying or trespass, may be sufficient deterrence for most scenarios. Under this view, the enforcement gap the rule creates is more theoretical than practical: the kind of drone that would ignore a federal restriction is probably already ignoring several other rules, and the legal apparatus to catch and prosecute those cases already exists.

That argument has limits. Remote ID only works on compliant hardware. Jamming, spoofing, and modified firmware can defeat it. And the facilities most worried about drone threats — nuclear plants, chemical facilities, data centers — are often the ones whose adversaries have the resources and motivation to fly non-compliant aircraft. For them, a legal no-trespassing sign is not a deterrence mechanism. It is paperwork.

The broader question is whether this rule becomes the kind of security measure that outlives its moment. The 3.4-ounce liquids ban at airports was imposed in 2006 as a temporary response to a specific threat plot. Nearly twenty years later, the Transportation Security Administration still enforces it. The pattern is familiar: a security measure introduced under urgency becomes permanent through institutional inertia, and the original justification fades from memory while the restriction remains. Section 2209 designations — particularly the five-year Special UAFRs — could become the drone equivalent. A facility that secures its airspace designation in 2026 may hold that easement in 2031 not because the threat has grown, but because the process to remove it is more burdensome than keeping it.

Industry groups have been pushing for Section 2209 implementation since at least 2021, when the Commercial Drone Alliance called it crucial for national security. Their argument then was that drone threats were increasing and operators needed a legal tool. The tool they got says what they cannot do.

The comment period closes July 6, 2026. Whether anyone uses it to point out the enforcement gap, or whether the gap is the feature rather than the bug, will determine whether this is the rule that closed a decade of waiting or the one that proved the waiting was the point.