The use of drones is increasing rapidly in Sweden, in both the private and public sectors. But as technology develops, questions arise about safety, cyber protection and how we can prevent sensitive information from falling into the wrong hands.
Drones have become an increasingly common feature of Swedish infrastructure. As technology has advanced and prices have fallen, organisations, companies and authorities have started using them for various purposes, including photography, filming, mapping, surveillance and military operations.
Drone operations: an industry for the future.
"Drones have become cheaper, more autonomous, and far more useful," says Åsa Olsson, Head of the Reliable Transport Systems Unit at RISE. "Improvements in batteries and cameras, not to mention simpler licensing processes, have also contributed to this. All of these factors have contributed to a rapid increase in their use."
We have conducted tests that show that there are drones that leak information.
With the rapid advance of technology, she believes that the areas of use will only continue to grow.
“Drones could have many more applications – for instance, they could act as mobile defibrillators that respond when someone suffers a cardiac arrest. Personally, I like to imagine a future where I can fly to work in a drone,” says Åsa Olsson.
Advanced tools with great potential – and challenges
But increased use also brings risks.
“A drone is, after all, equipped with a computer that can connect to various systems. We’ve carried out tests showing that some drones leak information even though this isn’t mentioned in the manuals. The drone could therefore reveal its location, leak data, or transmit images,” says Åsa Olsson.
And just like any other computer, drones can also be hacked.
“If you’ve filmed sensitive or critical sites, that data could be lost – and someone else might gain access to the drone and the information stored in it,” she explains.
A major asset for future technology
It’s essential that awareness of communication security and protection against malicious code keeps pace.
“Drones store large amounts of data, which increases the risk of information falling into the wrong hands. Communication must be encrypted, and the drone should have backup functions,” says Åsa Olsson.
She recommends always asking the manufacturer or retailer whether a third-party evaluation has been carried out to verify how well the drone is protected against, for example, malicious code.
“There’s no explicit transparency – you have to ask the company whether the drone is certified.”
But there are also physical risks, such as collisions and weather conditions.
“Weather is an important factor when choosing a drone. For instance, if the drone isn’t rain-resistant, it could be damaged. There’s also a risk of collisions or of the drone damaging someone else’s property. That’s why it’s important to have appropriate insurance for the drone in case of an accident,” says Åsa Olsson.
Overall, there are many rules, which are sometimes complicated, for both the drone itself and its use.
Stricter requirements and a greater focus on safety
In addition to registration and licences for drones, there are also EU directives such as NIS2 and CRA (see the fact box below).
“Overall, there are many rules, some of which are complicated, for both the drone itself and its use. It is a rapidly growing area in which RISE can determine what applies,” says Åsa Olsson.
RISE specialises in drone operation, cyber security, and wireless communication. The organisation also has several specially adapted test and demonstration environments, as well as courses on the various regulations and training on the risks and safety of drone use.
"We conduct tests in a variety of environments and locations, such as forests, urban areas, fields, mountains, waterways and the sea, throughout Sweden. Cyber tests need to be carried out in a laboratory, while test flights are conducted on site with the necessary equipment and personnel," says Åsa Olsson.
RISE also conducts tests to analyse the information transmitted by drones, such as whether they can reveal their position and the images they take.
"These drones are advanced and users may not be fully aware of all their functions, especially since these are not always described in the manual. They could film or photograph a security object without the operator's knowledge, which could cause problems for the owner," says Åsa Olsson.
Three classifications of drones
There are three different categories of drones:
- Open category (A) – among other things, the drone may not fly higher than 120 metres and must not pose a risk to other aircraft, people, the environment, property or animals.
- Specific category (B) – this category is intended for flights that involve higher risks than those in the open category, such as monitoring crowds.
- Certified category (C) – used in high-risk applications. Drones in this category can, for example, carry people or be used for military purposes.
Several EU directives concern drone safety
The EU has a number of regulations concerning drones and cyber security.
The EASA Regulation focuses on airspace safety and stipulates that drones must not pose a risk to people, property or other aircraft. It also includes technical requirements to protect privacy and data.
The NIS2 Directive aims to strengthen cybersecurity across the EU and covers, among other things, operators who use or provide drone systems. It requires risk analyses, security measures and incident reporting.
The Cyber Resilience Act (CRA) requires digital products, both hardware and software, to meet basic cybersecurity standards, such as secure updates and incident reporting. The law will also make it easier for consumers and businesses to understand a product's security.