What happened
Help Net Security interviewed Nick Donarski, chief technology officer at RotorLab, about what councils, records clerks, insurers and auditors expect from a public safety drone programme. Almost none of it is about the aircraft.
The records clerk needs three things after a flight: the dispatch call number, who was flying, and the video. Risk adjusters want the airframe maintenance log, total motor runtime, charge counts on the specific battery pack, and proof the pilot's certification had not lapsed. Most programmes record stick time in an app and nothing else, with no battery tag, no call number and no checksum when the card is pulled.
He is direct about why that fails. When defence counsel asks months later for maintenance and telemetry tied to an arrest, nobody can reconstruct it. The comparison is to body cameras, where police spent a decade building chain of custody and digital vaults, then bought a drone and dropped an MP4 in an unindexed folder.
On publishing, he argues for a coarse itemised log rather than raw feeds: flight date, a wide two hour launch window, call classification, tail identifier and patrol district, with coordinates and track vectors kept off the public site. Routine civil flights belong on a dashboard quickly, while overwatch on a barricaded subject stays in evidence until trial and statutory holds expire.
The cyber risk sits in the ground station. Most run standard tablets that want to sync with cloud services, and pilots connect them to open hotspots or unsegmented city Wi-Fi, turning a controller into a bridge into municipal networks. Flight logs in flat spreadsheets have no audit trail, so he recommends hashing raw log files with SHA-256 on ingestion and moving them to write once storage.
Why this is a GRC story
If anyone can edit the log, the log is worthless. This is evidence integrity in an operational costume. A spreadsheet the whole team can edit cannot prove a maintenance entry was not backdated, and the fix, a hash at ingestion plus immutable storage, is the control a compliance function asks for on any record that may be litigated. The technology is trivial. The discipline is not.
Retention is a legal decision, not a storage one. Retention is the second lesson. Without a signed auto delete policy for non evidentiary transit footage, incidental video of backyards and pools captured on the way to a call is public property under state law. The publishing split is data minimisation applied to physical operations: aggregate numbers look evasive, raw data is unsafe, and the defensible middle is a log detailed enough to be credible.
His advice for small agencies generalises. Write the standard operating procedures, authorisation triggers, privacy boundaries and retention schedule first, and get legal and elected officials to sign what the aircraft may and may not do. Then use cheap controls properly: numbered battery shells in paint pen and a paper checklist catch the same failures an expensive platform would.
What to watch
Watch whether auto delete policies for transit footage become standard, because that document decides how much incidental recording sits inside public records law. Watch how small fleets evidence certification currency, where one lapse voids a clean file. And watch what follows publication: once logs are itemised, the next request is the telemetry behind them.
Attribution: Analysis based on Help Net Security and related public reporting. This article is original commentary, not a repost of the source material.