The SAFER SKIES Act, Explained: Who Can Counter Drones Now

The SAFER SKIES Act is the federal law, signed December 18, 2025, that lets state and local law enforcement counter drones for the first time — authority that previously belonged to a handful of federal agencies. The implementing rule from DOJ and DHS took effect July 1, 2026, and it redraws who can do what against a drone in U.S. airspace: for police, for event venues, for private security, and for everyone flying one.

There is a lot of confusion about what actually changed. This is the working breakdown: what the law says, and what it means depending on which seat you sit in.

The short version

• What it is: The SAFER SKIES Act (part of the FY2026 NDAA, Pub. L. 119-60, codified at 6 U.S.C. § 124n) plus a DOJ/DHS interim final rule (91 FR 41466, effective July 1, 2026) authorizing state, local, tribal, and territorial (SLTT) law enforcement and correctional agencies to conduct counter-drone operations under federal oversight.
• Two tiers: a Detection and Warning certification (a short online course: detect, identify, monitor, track, intercept the control link, warn the operator) and a Mitigation certification (a two-week resident course at the FBI's National Counter-UAS Training Center: disrupt, disable, seize control of, or down a drone presenting a credible threat).
• Who got nothing: private parties. The rule explicitly does not authorize private security or contractors to mitigate. Downing, jamming, or hijacking a drone remains a federal crime for anyone outside a certified government agency.
• What stayed legal for everyone: passive detection. Remote ID and ADS-B capture, and passive RF detection that does not decode communications content, sit outside the certification framework entirely.
• The clock: the authority sunsets December 31, 2031 unless Congress extends it. The public comment period on the rule runs through September 4, 2026 (Docket FBI-2026-0001). A $500 million FEMA counter-UAS grant program funds SLTT adoption across FY2026–27.

Now the deeper cut, audience by audience.

If you fly drones (or just live under them)

For operators, the practical change is that far more badges can now see you, and some can act. Before July 2026, the agencies that could lawfully track your control link or take action against your aircraft were federal and few. Now any certified local department can detect, identify, and track a drone, intercept its control communications, and warn the operator — and mitigation-certified units can disable or down an aircraft they assess as a credible threat to people, facilities, critical infrastructure, public gatherings, or correctional facilities.

What that means in practice: Remote ID compliance matters more, because it is the first thing a certified unit reads. Flying near stadiums, large events, or anything with a flight restriction now carries real interdiction risk rather than just a fine in the mail. And "I didn't know" runs out faster when the responding officer has a track history of your flight.

For the general public, the rule builds in privacy guardrails worth knowing about: intercepted communications carry a 180-day retention limit, operations require minimization procedures and First Amendment compliance, agencies are subject to audits, and the Attorney General holds suspension authority over agencies that violate the rules. Whether those guardrails hold is a fair question; the comment docket is open through September 4, 2026 for anyone who wants a say.

Private security and protective teams

The blunt version: you got clarity, not authority. The rule leaves the private-sector line exactly where it was and states it directly. Private contractors may design, manufacture, install, and maintain counter-UAS systems, but may not operate mitigation. For a private team, downing a drone still implicates destruction of aircraft (18 U.S.C. § 32 — a drone is an aircraft), hijacking its link still implicates aircraft piracy (49 U.S.C. § 46502) and computer fraud (18 U.S.C. § 1030), and jamming still puts you in front of the FCC.

What the rulemaking did hand private teams is a clean statement of the lawful lane. Remote ID and ADS-B capture, and passive RF detection, fingerprinting, and classification that does not decode content, require no certification at all. That is a workable detection posture: eyes, Remote ID receivers, passive sensors — early warning, a track history, and an operator location to hand to responding officers.

The other change is the hand-off. Your local jurisdiction may now hold real counter-UAS authority, and the protective advance should find out — which agency, which tier, and who answers during your movement window. We cover how to fold that into the advance, and where the procurement traps sit, in Drones and the Advance.

A private team's counter-drone capability is detection plus liaison. The rule kept that arrangement in place; it just made the liaison half worth a lot more.

Event and venue security

This is the audience the rule was written for. The rulemaking record leans hard on the 2026 FIFA World Cup (including reports of hundreds of drones seized near match sites and fighter intercepts of unauthorized aircraft during the final) and on what's coming: the 2028 Los Angeles Olympics, the 2034 Salt Lake City Games, and the standing calendar of NFL, playoff, and motorsport events.

Two mechanics matter for event security directors:

• Standing protection for fixed sites. Operations plans normally cover a 30-day window, but fixed sites can hold a 365-day standing authorization, which means a stadium's local certified agency can maintain a recurring counter-UAS posture rather than rebuilding it per event.
• The venue still can't act on its own. A stadium can buy and host detection technology and wire it into its security operations center, but mitigation runs through the certified law enforcement agency. The venue's job is integration: shared detection picture, agreed thresholds, and a coordination cell where the agency's certified operators sit next to venue security.

For an event security lead, the planning questions are concrete: does our local agency hold certification, and which tier? Is our venue covered by a standing authorization or per-event plans? Whose detection feed is authoritative, and how does a track get from our sensors to their operators? The FCC's nationwide special temporary authority for approved RF systems and the federal authorized-equipment lists (21 systems at launch) decide what hardware can legally sit on the roof.

Law enforcement

SLTT agencies are the grantees, and the rule reads like a real operational program. Standing one up takes:

• Certification. Detection and Warning is deliberately cheap: a short online course, certification on completion. Mitigation is deliberately expensive — resident instruction at the FBI's National Counter-UAS Training Center, and only an agency's own certified officers can operate, never contractors.
• Governance. An agency implementation policy, a C-UAS operations plan per operation (or the standing fixed-site authorization), and an Agency Approving Official at senior executive rank accountable for use-of-force decisions.
• Technology discipline. Equipment comes off the federal Authorized Technologies and Authorized Systems lists; RF-emitting systems ride on the FCC's special temporary authority. The regulated line is decoding the control link — passive systems sit outside it.
• Coordination. Advance coordination through a single federal portal (FBI, FAA, FCC), real-time air traffic control notification within five minutes of activating mitigation, 48-hour post-mitigation reporting to DOJ and DHS, and privacy compliance with audit exposure.

The realistic adoption curve: most departments will take the detection tier quickly (it's nearly free and immediately useful) while mitigation concentrates in agencies covering stadiums, critical infrastructure, and correctional facilities. The $500 million FEMA grant program exists to pull that curve forward. For small agencies, the practical answer is detection certification plus a mutual-aid relationship with a mitigation-certified neighbor; that covers most of the ground.

Military

SAFER SKIES leaves military authority untouched, which is the point worth understanding. The Department of Defense has held its own counter-UAS authority since the FY2017 NDAA (10 U.S.C. § 130i) for covered installations and assets, and the air-defense layer above major events (the fighter intercepts in the World Cup record) remains a federal mission. None of that changed.

What changed is the ground around the fence line. Installations have long faced a seam: DoD authority ends at the boundary, and the drone loitering just outside it belonged to nobody with authority to act. A mitigation-certified county or city agency closes part of that seam, which makes the local liaison relationship, and joint planning for the seam, newly worth the effort for installation security.

One clarification that matters in this community: the rule covers law enforcement and correctional agencies. It does not deputize the National Guard, and a Guard unit supporting an event under state orders is not an SLTT law enforcement agency under this framework. The authority runs through the police department, not the uniform next to it.

What to watch

Three things will decide how much this rule matters by 2028: how many agencies actually certify (watch the FEMA grant awards), whether the comment period narrows the technology lists or the privacy provisions, and whether Congress extends the authority past the December 31, 2031 sunset. The airspace over American venues is now a shared jurisdiction problem. Like most jurisdiction problems, it will work best for the teams that map it before they need it.

---DIVIDER BLOCK HERE---

Arcline builds software for small teams running hard missions with little support. Request early access at arclinesystems.ai.