Key points
- Drones depend on radio control links and unauthenticated civilian GPS, both of which attackers can target.
- In 2012, University of Texas researchers took control of a civilian drone for the US Department of Homeland Security by spoofing its GPS signals.
- In January 2024, CISA and the FBI warned that Chinese-made drones could expose sensitive data about critical infrastructure.
Drones combine three things that make cyber risk physical: they fly over people, they depend on radio links and satellite navigation, and they increasingly carry cameras and sensitive data. This article looks at how a drone can be taken over or misled, what has actually been demonstrated, and why governments now treat drone fleets as a security issue.
How a drone can be taken over
Most drones rely on two links that an attacker can target:
- The control link. Commands travel by radio from a controller or ground station. Weak encryption or authentication can let someone else issue commands or cut the operator off.
- Satellite navigation. Drones use GPS to know where they are. Civilian GPS signals are not authenticated, so a stronger fake signal can feed a drone false position data, a technique known as spoofing.
A drone that is jammed may land, hover or return home, depending on how it is programmed. A drone that is spoofed may fly confidently in the wrong direction, which is more dangerous because nothing appears to be wrong.
What has been demonstrated
In June 2012, researchers at the University of Texas at Austin, led by Todd Humphreys, took control of a small civilian drone in a test for the US Department of Homeland Security by spoofing its GPS signals, using equipment they said cost about $1,000 (GPS World) (UT Austin Radionavigation Lab). The researchers warned that the same technique could be used against other GPS-dependent vehicles (Defense One).
The demonstration matters because it showed that taking over a drone does not require breaking into its software. Misleading its navigation can be enough.
Drones as a data and supply-chain risk
In January 2024, CISA and the FBI published guidance warning that drones made by companies based in China could expose sensitive data, including imagery of critical infrastructure, and recommended that operators of critical infrastructure review how their drones collect, store and transmit data (CISA and FBI). The concern here is less about a drone falling out of the sky and more about drones as a channel for collecting information on the infrastructure discussed in our series on cyberattacks that endanger human lives.
Where the risk to life comes from
- Collision and falling debris if a drone over a crowd, airport or road is hijacked or misdirected.
- Interference with aviation near airports and helicopter landing sites.
- Military and armed drones, where loss of control or spoofing can have lethal consequences. Public, verified detail on such incidents is limited, and claims made during conflicts should be treated with caution.
- Reconnaissance of power stations, water plants and transport hubs that could support a later attack.
Reducing the risk
- Use drones with encrypted, authenticated control links and keep their firmware updated.
- Configure safe fail-over behaviour, such as landing in a known safe area, when the control link or navigation signal is lost.
- For critical infrastructure operators, follow the CISA and FBI guidance on data storage, network isolation and supplier review.
- Plan for GPS interference: vehicles and drones that cross-check satellite navigation against other sensors are harder to mislead.
GPS spoofing is also a risk for ships, aircraft and road vehicles; see cyberattacks on transportation systems and cyberattacks on connected cars. The series overview covers how cyberattacks can endanger human lives across critical infrastructure.
Frequently asked questions
Can hackers take control of a drone?
Yes, in some circumstances. Attackers can target a drone’s radio control link or feed it fake GPS signals. In 2012, University of Texas researchers took control of a civilian drone in a test for the US Department of Homeland Security by spoofing its GPS.
What is GPS spoofing?
GPS spoofing means transmitting fake satellite navigation signals that are stronger than the real ones, so that a drone, ship or vehicle calculates a false position. Civilian GPS signals are not authenticated, which makes spoofing possible.
Why did CISA and the FBI warn about Chinese-made drones?
In January 2024, CISA and the FBI said drones from China-based manufacturers could expose sensitive data, including imagery of critical infrastructure, and advised operators to review how their drones store and transmit data.
How can drone operators reduce cyber risks?
By using encrypted and authenticated control links, updating firmware, setting safe behaviour when signals are lost, isolating drone data from sensitive networks and reviewing suppliers.
Last reviewed: 22 October 2026. This article is research and analysis based on publicly documented incidents, government advisories and published security research, linked inline.
