Civilian drones, privacy, and the federal-state balance

Introduction

Some say the federal government should be principally responsible for regulating drones,¹ nongovernmental actors, and privacy; others have suggested a blended approach, with states taking center stage and the national government cast in a supporting role. This essay takes essentially the latter position. As drones are folded further into American airspace, states should take the initiative, both by applying longstanding liability rules and by devising new ones. But we also should take advantage of the Federal Aviation Administration’s (“FAA”) small but growing competence in nongovernmental drones and privacy—and have the agency perform a kind of superintendence function.

Remotely controlled flying robots are increasingly cheaper, and at times more capable of sustained flight, than some manned counterparts. Many can be outfitted with imaging or other recording equipment, itself increasingly more affordable and widely available nowadays. An airborne droid might take in more information over a much longer period of time than a human eye or ear; and it might also find its way to areas where other aerial platforms might not be able to go. In this way drones pose real if manageable privacy risks. And policymakers have aimed to manage them following Congress’s call to broaden drones’ access to the skies by late 2015. The timing raises any number of big-ticket privacy questions. Two are recurring: which arm of the government (states or feds) ought to balance a proliferating technology’s benefits against its privacy costs; and which drones (government or private) will present the greatest threats to privacy.

On one side of the first question are certain members of Congress and civil liberties advocates, who have called for a robust federal approach to drones and privacy.² On the other are “drone federalists”: scholars³ and policymakers⁴ who generally oppose enactment of a preemptive, federal drone statute, and who would in any event keep federal regulation to a minimum or reserve it for discrete subjects only. In recent years, only states have passed legislation meant to account for America’s drone experiment and its implications for privacy. In that sense, momentum isn’t with the feds: the FAA, for example, pointedly refused to regulate privacy in a broad fashion (though, as explained below, it nevertheless undertook some drone privacy work later). And unlike some state houses, the U.S. Congress hasn’t seriously considered or passed a bill to set general privacy standards or to regulate drones and privacy specifically.

Meanwhile, state legislators mostly have their sights set on a particular class of drone—that flown by governments. The past few years have seen a raft of proposed and enacted laws, principally or exclusively aimed at restricting drone surveillance by public officials. Some states, like Florida, Utah, and Montana, generally preclude police from using drones, unless officers obtain a judicial warrant founded on probable cause or confront an emergency.⁵ Virginia probably takes the gold medal in this regard, having banned, with some exceptions, all public drone operation by state personnel until July 2015.⁶ We can guess the reasons behind the government-centric approach: the state’s unique power to imprison; the Constitution’s traditional protections against public rather than private action; and the fact that, like much in the realm of technica, the drone was initially developed for government applications and only afterwards transitioned to private ones. Drones had been a staple of military activities abroad for years, long before Congress even thought about widespread civilian operations. And, owing to the FAA’s current licensing scheme, drone pilots are frequently police or border security officers.⁷ It thus makes intuitive sense to prioritize policymaking for public aircraft—which the states largely have done that so far.⁸

Private actors will soon operate drones in equal if not greater numbers than the government.

But that’s just the thing: private aircraft matter, too. These days individuals, private universities and companies can and do fly surveillance-capable aircraft, both with and without the specific blessing that the FAA requires.⁹ As unmanned flight technology matures and grows ever cheaper, it will find its way into more private hands. The already swift clip will quicken, once the FAA writes rules for wider domestic drone flight. Suffice it to say private actors will soon operate drones in equal if not greater numbers than the government does—and also acquire the potential to undertake just as much surveillance. As pressing as the question of how best to safeguard “public” privacy, is the question of how best to safeguard its understudied counterpart, “private” privacy. The urgency is reflected in a handful of legislative proposals concerning drone surveillance, and in a decision reportedly forthcoming from the Obama Administration. Though details remain sketchy, the White House is set to order the National Telecommunications and Information Administration (“NTIA”) to develop, in consultation with various stakeholders, voluntary privacy guidelines for commercial drone use.¹⁰

This essay examines the current division of labor between state and federal governments, with respect to civilian drones and privacy. It proceeds in three parts, the first of which recognizes the most compelling reason, put forward by advocates of a state-based regime, for the states’ primacy in shielding “private” privacy rights. There’s already a state law fabric meant to safeguard those very rights, one woven of common law doctrines, statutes, and laws meant to account for drone surveillance in particular. This body of law will be increasingly relevant as more private drones fly, and civilian drone surveillance becomes more common. And, as the drone federalists rightly point out, currently there is no firm consensus about how best to safeguard privacy rights from non-governmental drone surveillance—something a top-down, federal approach would require.

Which arm of the government (states or feds) ought to balance a proliferating technology’s benefits against its privacy costs?

Still, as the essay’s second section explains, the FAA’s involvement in private drones and surveillance, though small, has been quietly increasing since 2012. This rather subtle development informs an argument at the heart of the third segment: the FAA’s emerging presence in “private” privacy and unmanned aerial surveillance supports a continued role for the agency in addressing the issue. Doing so would be consistent with recent practice. Moreover, incrementally adjusting the status quo, perhaps by having federal aviation officials take away the worst privacy violators’ drone flying credentials, would even be a good idea. A fourth section offers concluding thoughts.

The States’ Primacy

Opponents of a federal statutory scheme for civilian drones and privacy have broadly raised two claims, both of them valid.

An unannounced Quadcopter hover, inside a neighbor’s back yard barbecue and at hair-parting altitude, could theoretically put a drone operator on the hook for trespassing.

First, with some important federal-level exceptions, the law of “private” privacy and aerial surveillance largely is state law.¹¹ It is mostly tech-neutral, and accordingly has protected privacy from varied forms of surveillance by nongovernmental actors over time. When the drones take to the skies in greater numbers, a body of varied state rules will be waiting for them. And it will do much of the work in addressing civilian drone surveillance—though how well remains to be seen.

State privacy laws generally fit into one of three categories. In the first are longstanding statutory and common-law protections against non-governmental intrusions. Often it is both a crime and a tort to trespass on another’s property, for example by walking on it without permission.12 That is arguably just as true of low-level overflight. Thus an unannounced Quadcopter hover, inside a neighbor’s back yard barbecue and at hair-parting altitude, could theoretically put a drone operator on the hook for trespassing. This depends on how a state trespassing statute has been written and how far a court is willing to go in interpreting it.¹² Also in play are the classic state-law “privacy” offenses, which largely “cover what most people think of when they think of personal privacy and social privacy norms.”¹³ The prohibitions against invading privacy, intruding upon seclusion, publishing private facts, and stalking all might be implicated when a drone, heavily sensored up, hears or sees somebody who doesn’t wish to be heard or seen.¹⁴ Again, outcomes will depend on the fit between a case’s facts and criteria set by law. Simply filming a private conversation from a drone probably won’t tee up a publication of private facts claim, absent some effort on the snooper’s part to disseminate the conversation’s contents; a quick fly-by, even when paired with video filming, probably won’t rise to the level of an intrusion upon seclusion, either. A more sustained look might be a different story.
An unannounced Quadcopter hover, inside a neighbor’s back yard barbecue and at hair-parting altitude, could theoretically put a drone operator on the hook for trespassing.

More specialized rules make up the second group of state privacy laws. These include state wiretap laws, which preclude the recording of images or conversations without both parties’ consent. Also, the somewhat rare “Peeping Tom” and anti-voyeurism laws, which bar peeking into the home under certain circumstances; and equally rare paparazzi statutes, which “ban paparazzi from using special technologies to intrude on the personal life and personal spaces of celebrities.”¹⁵ Here too it is easy to imagine how drone surveillance might trigger one or more of the foregoing. An industrious peeping Tom, for example, might acquire a Parrot Drone, and fly it close enough to an unsuspecting neighbor’s bathroom window to snap a photo. It also goes without saying that paparazzi most assuredly will make ample use of surveillance technology—drones included—in their relentless and unending quest to keep up with the Kardashians.¹⁶

To the foregoing we can add a third and growing category: civil and criminal laws designed specifically to block unwanted aerial surveillance from privately owned, unmanned aircraft. So far, thirteen states have enacted these, either standing alone or coupled with statutes meant to account for surveillance from public aircraft. By way of examples, Tennessee handed down two “private” privacy statutes in 2014. One makes it a misdemeanor to conduct drone-based video surveillance of citizens who are hunting or fishing in accordance with state law.¹⁷ Another precludes, with exceptions, the use of an “unmanned aircraft to capture an image of an individual or privately owned real property … with the intent to conduct surveillance on the individual or property captured in the image,” when a snooper retains or publicizes the images. (There’s an odd and possibly rule-eating catch: one can escape liability by showing that, upon learning the images were obtained unlawfully, the drone operator promptly destroyed or stopped publicizing them.¹⁸) Wisconsin’s new drone law suggests a narrower scope of geographic application than Tennessee’s. Under the former, a private individual commits a misdemeanor by using a drone to “photograph, record, or otherwise observe another individual in a place where the individual has a reasonable expectation of privacy.”¹⁹

Two things stand out about this tripartite array. First, there’s a good-sized body of general privacy law out there, waiting to absorb the coming influx of domestic drones and associated surveillance. The second is diversity. Not all states define trespassing or drone surveillance in the same way, or apply identical privacy protections to identical places. Between its statutes and court-crafted doctrines, this jurisdiction might take a relatively stringent approach to the safeguarding of “private” privacy, while that one might take a relatively permissive approach. The phenomenon is most vividly on display with regard to drone-specific statutes; many states don’t have one to begin with, and thus accordingly handle nongovernmental privacy intrusions through a mix of laws in categories one and two. In this way, the law of “private” privacy is something of a hodgepodge. Its coverage can be expansive or porous or even non-existent, depending on where you are, and what sort of technology is deployed.

Not all states define trespassing or drone surveillance in the same way, or apply identical privacy protections.

That registers a second, related point in the drone federalists’ favor. We don’t quite yet know how effective any one’s state law will be, as the domestic drone population grows denser and private surveillance more pervasive; or which states’ laws will withstand court challenges. And we won’t have a better sense on either score for a while, either. The uncertainty will frustrate consensus about how best to regulate drones, snooping, and nongovernmental actors—and thus bolster states’ prerogatives in the short run.²⁰

So far as “effectiveness” goes, we really don’t have enough in the way of data just yet. Though unmanned aircraft are increasingly visible, they also are not yet an everyday feature of American life in the same way that manned craft very much are. This is not to suggest that domestic drone flight lies far off in some wild future or that it is weird or unprecedented. In fact, odds are pretty good you’ve seen a YouTube video of footage taken from a Quadcopter, or maybe even fiddled with making such a recording yourself. Or perhaps you’ve read about a safety incident involving a slightly larger but still small drone, or even operated one pursuant to the FAA’s licensing scheme. (So far the FAA says it has authorized only three commercial drone operations, two over water and another over land.)

Yet the odds are just as good that John Q. Citizen can go weeks, maybe even months, without laying eyes on a drone—or, more to the point, without a drone laying its eyes on him. The rough probabilities naturally vary from one place to the next. There is plenty of unmanned flight ongoing at test ranges, to name one obvious example; and camera-carrying model aircraft likewise probably are thicker in the air above North Dakota than above Washington, D.C. Still, this fact remains. The American drone era is in its adolescent phase, with the machines’ numbers steadily increasing, though still remaining small enough to keep civilian drone-snooping out of most peoples’ lives, most of the time.

For corroboration, consider that the courts’ dockets have been essentially empty—though not because the privacy-minded aren’t on the lookout. True, there have been legal challenges involving unmanned aircraft, snooping, and government: think criminal cases involving the acquisition of video or audio recordings in violation of the Fourth Amendment. The FAA’s power to enforce its licensing scheme is also in litigation.²¹ As far is the author is aware to date, plaintiffs have yet to bring any case turning on the relationship between individual privacy rights and civilian drone surveillance. That makes it hard to draw firm conclusions about whether Texas’s drone statute makes better sense than Oregon’s, and consequently, just as hard to make intelligent legislative tweaks. That’s not to suggest that policymakers are flying blind. As discussed above, there are many useful precedents hailing from other private surveillance contexts, and from more established but similar technologies: helicopters with cameras, reporters with Dictaphones, everyday people with cell phone cameras, and so forth. With these in hand, states have made some educated guesses about what rules will work best vis-à-vis drones.

But the analogies can only go so far. Two core assumptions inform modern drone policy: drones will allow for more aerial surveillance than other airborne platforms have to date, and more drones will soon find their way into more private hands. If these postulates prove even partially true, then drones are unique. And if so, then the precedents from the manned surveillance world will only get policymakers so far. Said differently, the efficacy and legality of new drone regulations will probably only come into relief once private drone flight and private drone surveillance become somewhat more commonplace.

On the “legality” point, consider this observation by two scholars: When at last the judiciary applies the law of “private” privacy to drone surveillance, many statutory or common law rules could be narrowed, or even invalidated, on First Amendment grounds. Restrictions made in the service of “private” privacy often will implicate the First Amendment.²² Of course, the push-and-pull between speech and privacy is at its most acute when the press’s information-gathering rights are curtailed, regardless of whether the gathering is accomplished through drone surveillance or other means. But First Amendment limits also come into play when governments seek to limit the rights of private individuals to uncover information antecedent to speech. The law here is largely unsettled. So far courts have been less forgiving of regulations that impinge upon the people’s ability to witness and record the words or actions of public officials, or events taking place in public or concerning issues of public interest.²³ That trend may or may not remain stable; there’s still line drawing to be done, and the final lines will depend upon further litigation.

How much would, for example, Google trample privacy, if it opted to have unmanned aircraft film the ground below, so as to help the company keep its earth maps current?

How much would, for example, Google trample privacy, if it opted to have unmanned aircraft film the ground below, so as to help the company keep its earth maps current? Would existing privacy rules constrain that effort not at all, too much, or just enough? Relative to State X’s drone law, does State Y’s drone law under- or over-protect “private” privacy, given the incidence of actual drone flights there? Should states emphasize homeowners’ rights against overflight, or the public’s right to discover information, or its ability to uncover hidden but unlawful surveillance? There are answers in state law, but they remain momentarily tentative.

We might not get to complete clarity. Different kinds of drones will fly in different jurisdictions, and to different degrees; many jurisdictions already view domestic drone proliferation more or less favorably than others. Together, such facts essentially guarantee a measure of policy diversity nationwide. At present, the policy landscape hasn’t begun to approach even that point. We lack general agreement about what an optimal set of liability rules might look like for drones and “private” privacy—something that a largely or even completely federal approach would seem to require and that the drone federalists have stressed.25 For now, pragmatism counsels against a heavy-handed federal response, and in favor of regulation at the state level.

The FAA’s Growing Drone Privacy Competence

That the national government hasn’t coalesced around a single, optimal approach doesn’t mean that policymakers can’t come to any agreement over standards for nongovernmental drone uses; or that federal officials shouldn’t assert some prerogatives in the privacy realm. Certainly recent events suggest otherwise. We don’t yet know what the White House’s order on commercial drones and privacy will look like. We also don’t know the voluntary privacy principles that, in carrying out the order, the NTIA ultimately will promulgate. But that plan’s very contemplation presupposes at least some federal guidance with respect to “private” privacy. The leading proposal for “drone federalism” likewise assumes that the FAA will use its licensing powers to make it easier for privacy plaintiffs to learn of unwanted drone surveillance.²⁴ All this makes sense given some recent but mostly unnoticed history. Despite the states’ longstanding primacy, the federal presence in civilian drones and privacy, though minimal, has been on the rise for some time now.

The FAA has opted for a rather privacy-opportunistic stance.

This began with a tiny shift in the FAA’s responsibilities. By dint of the Federal Aviation Administration Modernization and Reform Act of 2012 (“FMRA”), Congress instructed the FAA to lead several other executive branch agencies in a consequential, tight-timeframe project: to devise, by no later than late 2015, rules for the safe and wider use of drones inside the United States.²⁵ This was to be a technical, logistical endeavor; the statute’s drone provisions nowhere mentioned privacy.²⁶

That did not stop the agency from dipping a toe into privacy waters, if somewhat tentatively and at times inconsistently. On one hand, the agency scrupulously disclaims authority to delve deeply into privacy, instead emphasizing the FAA’s longstanding focus on aviation safety. On the other hand, aviation officials naturally accept that drones pose undeniable privacy challenges, and the dividing line between safety and privacy is often blurry. Having all this in mind, the FAA has opted for a rather privacy-opportunistic stance. It has put the concept to good use when needed, for example, to explain the agency’s slow progress, in keeping to FMRA’s quixotically fast calendar. And in one quite narrow context, the FAA has separately added privacy to its traditional slate of activities, if only in limited fashion, while making no commitments to follow suit later.

The impetus for all this was, ironically enough, FMRA itself. Among many other things, the statute called for limited drone flight at special test ranges, in advance of the 2015 deadline for broader drone integration. A new fleet of flying robots couldn’t be catapulted into American airspace overnight; the policy and logistical obstacles obviously were far too numerous and far too difficult for that. FMRA therefore called for a gradual transition, during which the FAA would run a type of beta-testing program. Drones would fly under controlled conditions, on an interim basis, and furnish data needed to resolve some of the tougher dilemmas posed by more widespread flight.²⁷ The initiative would go forward at six test ranges, which had to be selected by a date certain—on or about August 12, 2012, as the leading drone advocacy group interpreted FMRA’s text.

The outfit therefore complained when that date came and went, though without the FAA’s having named any of its six proving grounds.²⁸ In a response sent one month afterwards, the agency’s acting administrator, Michael Huerta, interpreted FMRA differently, and denied having missed any legally set deadline. But Huerta nevertheless justified the slower pace. “Privacy concerns have surfaced as a result of increased [drone] usage,” he explained, “and this necessitates an extensive review of the privacy impacts of the test site program.”²⁹ The message seemed clear enough. So far as the test sites were concerned, drone work (something very much within FAA’s portfolio) was partially privacy work (something pretty well outside of that portfolio, until then anyway). And privacy work was hard and time-consuming, enough to make for some slow sledding.

The agency did make progress, and eventually completed its privacy workup. The agency named six test range operators in late December 2013.³⁰ And, echoing Huerta’s earlier letter, the FAA’s release announcing the test site selections also mentioned certain “privacy considerations” that the FAA had taken into account. In particular, the agency said it had developed privacy rules that test site operators would have to follow.³¹

After draft rules were issued, the public was offered an opportunity to comment; the agency then weighed the public’s input before formulating some quite modest, final privacy requirements, in November 2013. They were essentially as follows: before proceeding, site operators would have to sign special contracts with the FAA. The contracts in turn would obligate each site operator to keep records of all drone flights, and to require each operator to have a written plan for use and retention of drone-collected data. Relatedly, the contracts also required the site operator: to maintain an openly available “privacy policy,” the contents of which were left up to the operator, and compliance with which would be assessed by the operator annually, in a manner accessible to the public; to obey any applicable privacy laws, then existing and subsequently enacted; and to acknowledge that the FAA might suspend test site authorization, upon the commencement of civil or criminal proceedings by the government, for violation of applicable privacy laws. The FAA might even terminate the authorization outright, if litigation later “demonstrates [that the test site’s] operation was in violation” of those laws.³²

In this way, privacy became part of the FAA’s long-term planning for unmanned aircraft. Recall that advocacy groups initially had pushed hard for the FAA to regulate privacy issues in a sweeping fashion. The agency resisted,³³ but acknowledged privacy’s obvious centrality to the enterprise of bringing more drones to more of America’s airspace. Thus the privacy rules, which, amidst a soup of qualifications and legalese, still managed to back the FAA into some modest, temporary duties in ensuring solicitude for privacy rights. At least theoretically, for so long as the test sites are in business—until February 2017 at the latest³⁴—the FAA can yank the authorizations for sites where egregious privacy violations are committed.³⁵ In that sense, the FAA tenuously has claimed a new kind of privacy jurisdiction.

Proving a privacy violation to the FAA’s satisfaction might well take considerable time and effort.

That jurisdiction is no doubt narrow and time-limited—two things the agency has emphasized, in seeking to tamp down expectations and avoid setting precedents. The final privacy rules govern only the six test sites. They do not commit the FAA to any forms of future privacy activity. Substantively, the rules also are pretty flimsy: site operators must have privacy policies, but just how rigorous or forgiving is up to the operators alone. Operators also must agree to obey current or future privacy law, mostly the state laws noted above—but that’s something operators would have to do anyway, whether or not the FAA ever took an interest in test range activities. Finally, the FAA’s power to suspend or rescind test site authorizations is conditioned upon prior action by state law enforcement or other regulators. A lawsuit by a private party, it seems, won’t suffice. Regardless of who brings the case, proving a privacy violation to the FAA’s satisfaction might well take considerable time and effort, maybe longer than a given test site’s life span. Swish all this around, and the FAA’s privacy standards (such as they are) start to seem pretty undemanding.

Still, those standards do exist. Like the FAA’s trotting out of privacy as justification for slowly naming test ranges, they imply a subtle evolution in the FAA’s job description, one occasioned by the singular complexity of domestic drone integration. This helps to explain why the FAA seems to embrace and to run from the concept at the same time. In issuing final test-range rules, the agency stressed the FAA’s abiding goal of “provid[ing] the safest, most efficient aerospace system in the world, [something that] does not include regulating privacy.”³⁶ Elsewhere in the same document, the agency explained that, by imposing privacy standards on test site operators, the FAA sought not to enter the privacy arena, but instead only to “inform the dialogue among policymakers, privacy advocates, and industry regarding the impact of UAS technologies on privacy.”³⁷ It was literally true that the FAA wasn’t making any new rules, and thus not “regulating” privacy; but clearly it also wasn’t rejecting privacy policy as none of its business. The FAA’s “roadmap” for domestic drone integration, also issued last year, sounds this note: it too denies a regulatory function for the FAA in privacy, while acknowledging at least some FAA efforts in the area.³⁸

Congress apparently has caught on to this. Consistent with the above, it quietly has reaffirmed the FAA’s small interest in privacy matters, while nevertheless emphasizing that the agency’s job function remains essentially unchanged. Explanatory materials appended to the Consolidated Appropriations Act of 2014 observed “the primary mission of the FAA is to protect the safety of civil aviation and provide an efficient national airspace. Nothing in the [document] is intended to change that mission or hinder the FAA’s ability to fulfill it.”³⁹ These magic words uttered, Congress still went on to fiddle with the FAA’s mission, if only just a little, by asking for it to undertake further privacy research:

Without adequate safeguards, expanded use of UAS and their integration into the national airspace raise a host of concerns with respect to the privacy of individuals. For this reason, the FAA is directed to conduct a study on the implications of UAS integration into national airspace on individual privacy. The study should address the application of existing privacy law to UAS integration; identify gaps in existing law, especially with regard to the use and retention of personally identifiable information and imagery; and recommend next steps for how the FAA can address the impact of widespread use of UAS on individual privacy as it prepares to facilitate the integration of UAS into the national airspace.⁴⁰

Note the “next steps” phrase and its gesture towards future FAA privacy work.

It would be wrong to over-read the language above, much as it would be wrong to over-read the FAA’s malleable privacy rules for drone-test ranges. Congress is not making the FAA the foremost guarantor of privacy rights in the United States; it is not giving the FAA the authority to sue for egregious privacy lapses; it is not calling for the FAA to become some aviation-focused outpost of the Federal Trade Commission. Instead, the legislature is simply doing what the FAA has been doing for a while: reiterating the FAA’s traditional remit in aviation safety, rejecting any implied dilution of its safety portfolio, and yet also quietly imposing modest new privacy responsibilities. It’s more mission creep than power grab.

That mission creep should inform our thinking about civilian drones, “private” privacy, and federal-state cooperation. The work of the FAA since 2012 can be plotted out as data points on a white board. And when connected, these suggest a slightly upward trajectory. Federal regulators gradually are taking on (unilaterally, or on instructions from Congress) more work, in addressing the privacy and technology tradeoffs posed by domestic drones. Call this “informing dialogue,” “regulating privacy” or something else; the label doesn’t matter especially. More important is the fact that federal oversight of civilian drones—marginal though that oversight may be—is on the upswing.

A Template for “Private” Privacy, Drones and Aerial Surveillance: State Law Foundation with Modest Federal Superintendence

We thus can review the bidding: states have a loose, largely untested framework in place for regulating nongovernmental, aerial surveillance. This in turn is supplemented by tiny pockets of federal activity, which have expanded modestly since 2012. The nascent trend is to tinker with this arrangement rather than to reshape it radically—say, by enacting an all-encompassing, state-law-preempting privacy statute. Exhibit A is Congress’s command to the FAA to study privacy issues further, following the agency’s issuance of FAA-enforced privacy rules for test sites; Exhibit B, the White House’s order and forthcoming NTIA principles. The latter reportedly will not address all privacy dilemmas associated with all forms of unmanned surveillance. Instead, after consulting with various stakeholders, NTIA eventually will issue voluntary privacy guidelines, which in turn will apply to commercial drone operations only, and which, as before, will reserve the defense of “private” privacy largely to background law.⁴¹

How you feel about the evident regulatory gap probably has to do with how you feel about likely sources and locations of unmanned aerial surveillance.

It is easy to imagine policy ideas that would keep the above architecture intact. By way of example, Congress could condition authorization to fly on a pledge to respect privacy. The FAA might insist that before receiving permission to operate an unmanned aircraft, a business or individual first would have to commit to observing applicable privacy laws.⁴² Thereafter, the FAA would have discretion to rescind the operator’s flight credentials, upon submission of proof that a court or similar body has faulted the operator for serious privacy violations under state law. The “seriousness” criterion here also could—and, so as not to jack up the cost of deploying a critical technology too much, likely should—be made stiff enough so as to capture only the worst varieties of unmanned aerial surveillance.⁴³

Keep in mind the scope. The FAA’s regulatory powers don’t extend everywhere and to every mode of unmanned flight. The limitation has implications for any FAA measure affecting privacy. For example, hobbyists’ “model aircraft” are mostly exempted from FAA regulation.⁴⁴ Going forward, how you feel about the evident regulatory gap probably has to do with how you feel about likely sources and locations of unmanned aerial surveillance. Thus, if you worry most about rampant Quadcopter eavesdropping, then the above proposal might not do that much to assuage you; such machines seemingly can be operated as “model aircraft,” and thus require no FAA license. Conversely, an FAA-based oversight approach to privacy might help considerably, if you predict that the most intrusive surveillance technologies will be paired with larger-sized drones—that is, drones likely to come within the FAA’s jurisdiction, and to require operator certification and training.⁴⁵

A proposal like the above (or one like it) would mean only incremental change. After all, the FAA already exercises a comparable authority over operators of the six test ranges established under FMRA. It wouldn’t take too much to have the FAA carry forward, on a permanent basis and with respect to unmanned aircraft within its jurisdiction, a variant of the humble privacy responsibilities it already has taken on unilaterally. Doing so would not obligate the FAA to “regulate privacy” in some broad or agency-inappropriate fashion, either. Instead the states would do the regulating, and afterwards, private litigants and state regulators would do the litigating and state courts the adjudicating. The FAA would only get into the mix afterwards, and only in the most deserving of cases.

Of course, that the above or any other policy change would fit nicely with existing institutional arrangements does not justify that policy’s adoption. But there are good reasons to extend federal oversight of drones and “private” privacy, while the adequacy of the underlying state law framework comes into sharper focus. Take the idea sketched out above. The largest companies have the greatest ability to acquire the most sophisticated unmanned aircraft, and thus also to engage in the most far-reaching surveillance. It happens that those same companies could be best situated to withstand the kinds of ex post remedies courts typically impose upon rampant privacy violators—injunctions, money damages, and the like. In that respect, the scheme above might prove helpful, by deterring the worst privacy violations—not the marginal or the really bad, but the worst—in advance of wholesale domestic drone integration, and in advance of long and uncertain litigation in state courts. But whatever the policy might ultimately look like, the federal government’s competence in civilian drones and privacy, such as it is, should be brought to bear.⁴⁶

Conclusion

A lack of mission-critical data cuts against having the federal government dive headlong into crafting liability rules for civilian drones and privacy. It would be hard to design a preemptive, national-level policy without knowing more about what sorts of drones will fly, what sorts of privacy rules will survive a first round of legal review, and so forth. State regulation and drone integration together will furnish some key answers to those questions over time. To put the point somewhat differently, the principal “drone federalist” arguments seem mostly correct.

But there’s a downside, and it hints at small regulatory space that federal officials shouldn’t be shy about filling. A lot of surveillance, intrusions on privacy, and First Amendment litigation will have to happen before workable and broadly applicable solutions come fully into view. As that process goes forward, the national government—the FAA in particular—has sufficient experience to minimize the short-run privacy costs.

It should take further steps to minimize them as domestic drone integration proceeds, and without fretting too much about diluting the agency’s heartland expertise in aviation safety. The dividing line between safety and privacy isn’t especially neat or obvious, as the post-FMRA years amply demonstrate.⁴⁷ And when all is said and done, the FAA will have a basic fluency in drone privacy, as well as a broad and deep understanding of drone safety, perhaps the two most critical pieces of the of domestic drone puzzle. The combination is unique and should not go to waste, as civilian drones grow less novel and more commonplace, and the country mulls the best approach to “private” privacy and aerial surveillance.

ABOUT THE AUTHOR

Wells C. Bennett was a Fellow in National Security Law at the Brookings Institution and Managing Editor of Lawfare.