11.3 Security Restrictions, No-Fly Sites & Dangerous Goods Prohibition

11.3 Security Restrictions, No-Fly Sites & Dangerous Goods Prohibition

[!NOTE] The Security and Safety Imperative: While airworthiness rules protect aircraft from aerodynamic stall and collision avoidance rules protect manned aircraft from mid-air strikes, aviation security (sûreté aérienne) protects society from the malicious, unauthorized, or catastrophic misuse of unmanned aircraft. In the Open Category, European lawmakers adopted an uncompromising standard: operations must remain strictly low-risk, non-hazardous, and insulated from security risks. To achieve this, European law imposes strict geographic flight bans around critical infrastructure, demands proactive cybersecurity protection, and mandates an absolute ban on carrying dangerous goods or dropping any materials.

Remote pilots operating in European airspace bear a direct civic and legal responsibility to safeguard civil security. A failure of operational discipline around critical infrastructure or hazardous payloads does not merely risk an administrative fine—it can trigger counter-UAS defensive responses, severe criminal prosecution, and acute endangerment of public safety.

---

Protecting Critical National Infrastructure (CNI) and Sensitive Facilities

Unmanned aircraft possess the unique ability to bypass ground perimeter security fences, biometric checkpoints, and physical barriers. Because of this capability, European Member States utilize UAS Geographical Zones established under Article 15 of Regulation (EU) 2019/947 to completely exclude or severely restrict drone flights around sensitive locations and Critical National Infrastructure (CNI).

+-----------------------------------------------------------------------------------+
|                CRITICAL NATIONAL INFRASTRUCTURE PROTECTED FROM UAS                |
+-----------------------------------------------------------------------------------+
|  Energy & Power:        - Nuclear power generation stations and research reactors |
|                         - High-voltage electrical substations and transformer hubs|
|                         - Hydroelectric dams and municipal water treatment plants |
|                         - Oil and gas refineries, pipelines, and fuel depots      |
+-----------------------------------------------------------------------------------+
|  Defense & Public Order:- Active military bases, training areas, and naval ports  |
|                         - Ammunition depots, armories, and defense radar stations |
|                         - Police headquarters and emergency dispatch hubs         |
|                         - Prisons and correctional institutions                   |
+-----------------------------------------------------------------------------------+
|  Government & Diplomacy:- Parliament buildings, presidential and royal residences |
|                         - Federal ministries and supreme constitutional courts    |
|                         - Foreign embassies, consular compounds, and summits      |
+-----------------------------------------------------------------------------------+
|  Transportation Hubs:   - Commercial airports, control towers, and runway axes   |
|                         - High-speed rail switching corridors and sea terminals   |
+-----------------------------------------------------------------------------------+

Why Sensitive Sites Demand Total UAS Exclusion

1. Nuclear Facilities: Drones present collision risks with delicate cooling towers, electrical switchyards, and spent fuel storage facilities. Furthermore, airborne reconnaissance could aid malicious targeting.
2. Prisons and Correctional Facilities: Unmanned aircraft represent a persistent contraband delivery vector used to smuggle narcotics, mobile telephones, weapons, and escape equipment directly into prison exercise yards.
3. Government Ministries and Diplomatic Enclaves: Drones pose espionage risks, optical eavesdropping threats, and physical security disruption for heads of state and visiting diplomatic delegations.
4. Commercial Airport Protected Corridors (CTR): Stray drones can force full airport shutdowns, diversion of dozens of commercial airliners, and risk catastrophic jet engine ingestion during landing and takeoff.

Article 15 UAS Geographical Zones

Under Article 15 of Regulation (EU) 2019/947, Member States publish geographical zones in a standardized, machine-readable digital format. In class C1, C2, and C3 drones, the onboard geo-awareness system ingests these digital boundaries, warning the pilot when approaching a restricted security zone. Flying inside a published security no-fly zone without explicit statutory authorization from the competent security authority is a serious criminal offense.

---

Cybersecurity of the UAS System

A drone is an interconnected computer system flying through radio frequencies. Securing the unmanned aircraft system against cyber intrusion, unauthorized takeover, and software manipulation is an essential pilot responsibility.

                        KEY CYBERSECURITY VULNERABILITY VECTORS

     [RF Jamming / Spoofing]                [Malicious Firmware Hacks]
             │                                         │
             ▼                                         ▼
    +───────────────────+                     +───────────────────+
    | Command & Control |                     | Onboard Flight    |
    | (C2) Radio Link   | <──[UAS SYSTEM]──>  | Controller & IMU  |
    +───────────────────+                     +───────────────────+
             ▲                                         ▲
             │                                         │
     [Weak Wi-Fi Passwords]                 [Unverified Sideloaded Apps]

1. Securing the Command & Control (C2) Link

• Default Wi-Fi Passwords: Many consumer drones and smart controllers broadcast local Wi-Fi networks with factory-default passwords (e.g., 12345678). Pilots must immediately change these default credentials to strong, alphanumeric passwords to prevent unauthorized third parties from intercepting telemetry or commandeering flight controls.
• Firmware Encryption: Modern C-class drones employ encrypted digital communication protocols between the Ground Control Station (GCS) and the aircraft to prevent eavesdropping and signal hijacking.

2. Firmware Updates and Vulnerability Patching

• UAS manufacturers routinely release firmware updates that patch critical cybersecurity vulnerabilities, improve geo-awareness airspace databases, and refine failsafe algorithms.
• Pilots should apply verified manufacturer updates promptly through official channels before commencing flight operations.

3. The Dangers of Third-Party "NFZ Removal" Hacks

Exam syllabi specifically address the illicit modification of UAS software. A flourishing black market exists offering software "jailbreaks," "NFZ removal patches," and "altitude limit removers":

[!CAUTION] Legal and Technical Consequences of UAS Software Hacks:

• Loss of CE Class Conformity: Applying unauthorized third-party firmware or modifications invalidates the drone's CE class identification label (C0-C4) under Delegated Regulation (EU) 2019/945.
• Immediate Shift to Unclassed Drone: The drone becomes an unclassed "legacy" aircraft, instantly losing Subcategory A1 or A2 privileges and being relegated to Subcategory A3.
• Voided Insurance: Operating hacked or tampered flight software breaches insurance warranty terms, causing immediate denial of coverage and total personal liability.
• Criminal Liability: Intentionally bypassing statutory geofencing around airports or nuclear facilities triggers severe criminal prosecution under aviation security statutes.

4. Avoiding Sideloaded and Unverified Flight Apps

Pilots must only utilize genuine, verified flight control applications distributed through official app stores or direct from the manufacturer. Sideloaded APKs or unverified utility apps may contain spyware, telemetry loggers, or corrupted flight control routines that cause inflight disconnects and fly-aways.

---

Illicit Interference and Suspicious Activity Protocols

Under European aviation regulations, remote pilots serve as responsible eyes on the ground and must know how to respond to acts of unlawful interference:

Recognizing Radio Interference and Spoofing

• RF Jamming: Manifests as sudden, simultaneous loss of C2 link and video telemetry, even at close range. When jammed, the drone should initiate its automated failsafe (Return-to-Home or auto-land).
• GPS / GNSS Spoofing: The drone displays erratic positional jumps on the map, false ground speed readings, or attempts to fly away due to fake satellite coordinates. In this event, the pilot must immediately switch to manual attitude mode (ATTI mode), disengage automated navigation, and perform an immediate controlled landing.

Reporting Suspicious UAS Activity

If a remote pilot observes an unidentified drone operating recklessly around an airport runway, hovering near a prison perimeter, or flying over a nuclear plant, the pilot has a civic duty to report the activity immediately to local police and the National Aviation Authority under Regulation (EU) No 376/2014 (Occurrence Reporting).

---

The Absolute Prohibition on Dangerous Goods (Article 4(1)(f))

One of the most heavily tested legal provisions in the EASA Open Category examination is the prohibition on transporting dangerous goods.

+-----------------------------------------------------------------------------------+
|          REGULATION (EU) 2019/947 - THE TWO SEPARATE LEGAL PROVISIONS             |
+-----------------------------------------------------------------------------------+
|  ARTICLE 4(1)(f)  - Open category classification condition:                       |
|    "during flight, the unmanned aircraft does not carry dangerous goods and       |
|     does not drop any material"                                                   |
|                                                                                   |
|  UAS.OPEN.060(3)  - Duty of the remote pilot and UAS operator:                    |
|    "remote pilots and UAS operators shall not fly close to or inside areas        |
|     where an emergency response effort is ongoing unless they have permission     |
|     to do so from the responsible emergency response services"                    |
+-----------------------------------------------------------------------------------+

Definition of Dangerous Goods

Regulation (EU) 2019/947 supplies its own definition in Article 2(11) — articles or substances capable of posing a hazard to health, safety, property or the environment, carried as payload, including explosives, gases, flammable liquids, flammable solids, oxidising agents and organic peroxides, toxic and infectious substances, radioactive substances and corrosive substances. The classification detail comes from the ICAO Technical Instructions for the Safe Transport of Dangerous Goods by Air (Doc 9284) and the European Agreement concerning the International Carriage of Dangerous Goods by Road (ADR):

"Articles or substances which are capable of posing a hazard to health, safety, property or the environment and which are shown in the list of dangerous goods in the Technical Instructions or which are classified according to those Instructions."

Dangerous Goods Classification Overview (ICAO / ADR Classes)

The Critical Distinction: Propulsion Batteries vs. Cargo

Candidates often wonder: "If lithium batteries are Class 9 Dangerous Goods, how can any electric drone fly legally?"

• Propulsion Batteries: The lithium-polymer (LiPo) or lithium-ion battery installed inside the drone to power its avionics and electric motors is certified equipment necessary for the operation of the aircraft. It is part of the certified airframe and does NOT constitute the carriage of dangerous goods cargo.
• External / Cargo Batteries: Transporting spare, uninstalled lithium batteries as external freight, payload, or air cargo IS classified as transporting dangerous goods and is strictly prohibited in the Open Category.

Pyrotechnics and Aerial Fireworks

Exam scenarios frequently ask about attaching smoke flares or fireworks to a drone for an aerial photography celebration or wedding display. Attaching any pyrotechnic device (Class 1 explosive) to a drone in the Open Category is an absolute statutory violation, punishable by severe aviation fines and criminal penalties.

---

The Absolute Prohibition on Dropping Objects or Materials

The same provision that bans dangerous goods — Article 4(1)(f) of Regulation (EU) 2019/947 — imposes an unconditional ban on dropping any material during flight.

                    THE DROPPING OF OBJECTS / PAYLOADS REGIME

                     Does the planned flight involve dropping
                      or discharging ANY material or object?
                                  /             \
                                YES              NO ──> [OPEN CATEGORY PERMITTED]
                                /                       (Standard payload attached)
                               /
     +─────────────────────────────────────────────────────────────+
     | ABSOLUTELY PROHIBITED IN THE OPEN CATEGORY                  |
     | - Dropping flyers, leaflets, or candy                       |
     | - Dropping recreational fishing bait                         |
     | - Dropping water balloons, confetti, or parachute toys      |
     | - Spraying agricultural water, fertilizers, or pesticides   |
     +─────────────────────────────────────────────────────────────+
                               │
                               ▼
     +─────────────────────────────────────────────────────────────+
     | MUST TRANSITION TO THE SPECIFIC CATEGORY                    |
     | Requires:                                                   |
     | 1. Operational Authorization from NAA via SORA or PDRA      |
     | 2. Risk assessment for ground impact and kinetic energy     |
     | 3. Approved ground containment zone                         |
     +─────────────────────────────────────────────────────────────+

Why Dropping Objects is Strictly Banned in the Open Category

1. Kinetic Energy and Impact Hazards: Even a soft object dropped from altitude accelerates due to gravity, posing severe injury risks to unsuspecting individuals on the ground.
2. Unguided Fall Trajectories: Crosswinds, thermals, and aerodynamic drag cause dropped objects to drift unpredictable distances away from the intended drop target.
3. Aircraft Center of Gravity Shifts: Releasing an underslung payload instantly changes the drone's mass and center of gravity, risking flight controller instability, motor overspeed, or sudden loss of control.

Common Real-World Scenarios That Violate This Rule

• Attaching a release hook to drop fishing bait or lures into coastal waters.
• Dropping promotional flyers, leaflets, or discount vouchers over a sporting event.
• Dropping candy or confetti over a birthday party or wedding.
• Dropping water bombs or parachuting toy figures in a park.

All of these activities are strictly illegal in the Open Category. Conducting an operation that drops any object requires formal authorization in the Specific Category based on an approved SORA risk assessment.

---

Summary Matrix: Payload and Security Rules Across Categories

---

Practical Flight Scenario: Wedding Event Request

+-----------------------------------------------------------------------------------+
| SCENARIO: A wedding planner offers a remote pilot €1,000 to fly a C2-class drone |
| over an outdoor vineyard wedding reception to release a shower of rose petals     |
| and attach two small electric cold-spark fireworks for the cake-cutting ceremony. |
|                                                                                   |
| 1. Payload Dropping Check: Dropping rose petals is an absolute violation of       |
|    Article 4(1)(f). Dropping ANY material is banned in Open.                      |
| 2. Dangerous Goods Check: Cold-spark pyrotechnic units are Class 1 explosives     |
|    under ICAO Doc 9284 / ADR. Carriage of dangerous goods is banned in Open.      |
| 3. Assembly Overflight Check: Flying over an outdoor crowd of wedding guests      |
|    violates the strict crowd overflight ban in all Open subcategories.            |
| Pilot's Action: The remote pilot must REFUSE the request immediately. Conducting |
| this flight in the Open Category would violate multiple statutory prohibitions,   |
| leading to automatic license revocation, major fines, and personal liability.     |
+-----------------------------------------------------------------------------------+

---

Common Exam Traps & Pitfalls

• Trap: "Biodegradable Materials Can Be Dropped": Candidates often think that because rose petals, paper leaflets, or fish bait are organic and biodegradable, dropping them is allowed. The law makes zero exception for material type: dropping ANY material or object is completely banned in the Open Category.
• Trap: Conflating Drone Batteries with Dangerous Goods Cargo: Remember that the drone's own installed propulsion battery is certified flight equipment, NOT cargo. Dangerous goods rules prohibit carrying hazardous materials as freight or external payloads.
• Trap: Assuming Jailbreaking Firmware Only Affects Warranty: Modifying firmware to bypass altitude limits or geofencing is not just a consumer warranty issue—it invalidates the CE class mark (Regulation 2019/945), strips insurance coverage, and constitutes an intentional breach of aviation safety law.
• Trap: Believing Emergency Service Overflight is Permitted: Point UAS.OPEN.060(3) — a separate provision from the dangerous-goods rule — explicitly commands remote pilots and UAS operators not to fly close to or inside areas where an emergency response effort is ongoing (such as a forest fire, traffic accident, or search and rescue mission) without explicit authorization from the incident commander.