An Open Letter to the FCC on Commercial Drone Security and American Innovation

The FCC's actions on foreign-made drones are a necessary first step. Here's what the policy needs to get right next to actually strengthen U.S. commercial drone security.

The Federal Communications Commission's (FCC) recent actions restricting foreign-made drones and components from Chinese manufacturers have made one thing very clear: the United States is serious about reducing dependence on foreign drone supply chains and strengthening domestic drone manufacturing.

That’s a worthwhile goal. Domestic manufacturing in general, and a more resilient American drone ecosystem in particular, are in the national interest. 

But if the FCC’s new policy really is about security, not just onshoring, then the next phase of policy needs to get more precise. 

Recent updates from the FCC suggest movement in that direction. The introduction of conditional approvals for certain drone systems signals an early shift toward evaluating systems more holistically, rather than treating all foreign involvement as a single category of risk. That’s a positive development. But it also highlights how much more clarity is still needed in defining what actually constitutes risk in a modern drone system. 

Country of origin matters, but it’s not the same thing as cybersecurity. 

I personally struggle to see how a rotor made in an allied country would pose a security concern. But I can definitely see how an internet-connected software system with weak access controls, poor update practices, or unclear data flows would cause security issues, even if it's made in the United States.

Software can introduce vulnerabilities anywhere if the standards, architecture, and operational discipline are weak. The FCC's own rationale for adding foreign-produced drones to the Covered List included concerns such as sensitive data harvesting, remote unauthorized access, and disablement via software updates. Those are software and systems risks as much as they are country-of-origin concerns.

The FCC's own rationale for adding foreign-produced drones to the Covered List cited sensitive data harvesting, remote unauthorized access, and software-based disablement — all of which are drone cybersecurity and drone software security concerns, not purely manufacturing origin concerns.

That distinction matters for commercial drone innovation. 

The Commercial Drone Market Can't Wait for Policy to Catch Up

Today, the U.S. commercial drone market is trying to do two hard things at once: rebuild domestic manufacturing capacity and keep serving real operators in agriculture, utilities, infrastructure, and public safety. 

These are teams that need to spray during a three-day weather window or inspect a line after a storm — not wait for a policy cycle to settle. 

The policy challenge is to encourage more American capability without accidentally slowing the very companies trying to build that market. 

In agriculture especially, operators are making practical purchasing decisions. The 2025 American Spray Drone Coalition survey found that 49% of operators would refuse to pay any premium for an American-made drone, while 41% said they would pay only a 1–25% premium. Performance remains the dominant factor. 

That means policy should reward secure, high-performing systems, not just domestic assembly in the abstract. 

What the FCC DRONE POLICY should ADDRESS next 

First, distinguish more clearly between hardware origin risk and software/system security risk. 

Not every component presents the same threat profile. Rotors, structural parts, and some mechanical components are not the same as connected control systems, radios, data infrastructure, or cloud-linked software. If the FCC wants to improve security outcomes, the framework should reflect those differences. 

Second, create a pathway that explicitly recognizes the role of allied-country components in rebuilding a competitive U.S. supply chain. 

Commercial drones grew out of global consumer electronics and light manufacturing ecosystems. Allied countries such as Japan, South Korea, Taiwan, and Germany have strong capabilities in components and electronics. A policy that treats all non-U.S. origin content the same risks making it harder, not easier, for American manufacturers to scale while domestic capacity is still being built. The FCC’s January 2026 update already reflects some flexibility by exempting Blue UAS Cleared List products and Buy American-compliant end products through January 1, 2027. That logic could be extended in a more durable way. 

Third, give software a more explicit role in how security is evaluated. 

If software is where sensitive data is routed, stored, updated, and governed, then drone software security standards should include: 

• secure hosting and storage architecture 
• access controls and user permissions 
• software update and patching discipline 
• auditability of data flows 
• segregation of operational and customer data 
• incident response readiness 
• 
  

Those are the kinds of measures that actually determine whether a system is secure in practice. 

Fourth, align policy with the reality of commercial operations, not only defense procurement logic. 

The Covered List framework is being interpreted by many manufacturers through a defense lens, but commercial operators have different needs. They need durability, affordability, uptime, and support over time. They are not buying attritable systems. They are buying tools that must work reliably in the field every day, for years. Policy should support that market too. 

Finally, provide more clarity and predictability. 

Right now, uncertainty itself is part of the problem. Manufacturers need to know what qualifies, what does not, how exemptions are handled, and what role software can play in meeting security expectations. Capital follows clarity. Innovation does too. 

The FCC has already taken a significant first step by forcing the market to confront supply-chain risk. The next step is making sure the policy encourages a stronger commercial ecosystem, not just a narrower one. 

American manufacturing is worth building. But if security is the real objective, then standards, architecture, and software discipline need to matter just as much as country of origin. 

That is how we strengthen the U.S. drone industry for the long term. 

At American Autonomy, Inc., we've built our drone software platform around exactly these principles — U.S.-built, hardware-agnostic, and designed with secure hosting, access controls, and auditability at its core. If you're a drone manufacturer navigating FCC compliance and looking for a software partner built for this environment, we'd like to talk.

Learn more at American-Autonomy.com.