Privacy guidelines issued for government drones

New memo guards against cross-agency sharing, but leaves large loopholes.

UAV in flight

Federal agencies use unmanned aerial systems to conduct border surveillance, track wildfires, and for other purposes like law enforcement and research. As part of an evolving federal policy, President Barack Obama on Feb. 15 announced a set of principles intended to integrate privacy and civil liberties protections into the way the government uses drones.

The presidential memorandum extends Privacy Act protections to government drone use, specifying that drones can collect information or use information collected by drones only for authorized purposes, and that personally identifiable information collected by drones must be deleted within 180 days, unless otherwise required by law or regulation.

The new rules, which apply to all executive agencies, also put restrictions on inter-agency sharing of data collected by drones, "unless dissemination is required by law, or fulfills an authorized purpose and complies with agency requirement," per the memorandum. The rules also require agencies to make policies that prohibit any drone-based data collection or retention that targets individuals based on their beliefs, or on their race or gender.

Civil libertarians and many in Congress have long worried that the use of drones by government agencies could lead to mission creep, with data collected incidentally for one purpose -- say wildlife tracking, agricultural mapping or a search-and-rescue mission -- being used for unrelated law-enforcement purposes.

"There's legitimate concern about insufficient safeguards in place to make sure drones aren’t used to spy on American citizens, perhaps unfairly enforce criminal law, and unduly infringe on individual privacy," said Sen. Charles Grassley (R-Iowa).

Additionally, there is the prospect of how drones might be networked and programmed. In a Senate hearing in January 2014, Chris Calabrese of the American Civil Liberties Union raised the specter of drones being used to power dragnet government surveillance. "Fleets of drones, interconnected and augmented with analytics software, could enable the mass tracking of vehicles and pedestrians around a wide area," Calabrese said.

Constitutional and regulatory checks on the domestic use of drones already exist, including Federal Aviation Administration rules on flights in U.S. airspace. The Obama memorandum expands on those controls with requirements that agencies set oversight policies governing the use of drones, training of feds and contractors who come into contact with information collected via drones, and to make sure that information gathered using drone technology conforms to current law. Agencies are also required to disclose where drones are permitted to fly in U.S. airspace, and changes to drone programs that "would significantly affect privacy, civil rights, or civil liberties," per the memorandum.

The memo puts the onus on agencies to review existing policies at least every three years, but also when deploying new technology. However, the document does not specify what qualifies as a new technology -- whether a new model of vehicle, or a new video or audio collection capability, or new software to organize and analyze data.

Additionally, the FAA put out a 195-page draft rule to clarify how commercial drones weighing less than 55 pounds can operate in U.S. airspace. The proposal includes a 500-foot limit on flying altitude, a maximum 100 mph airspeed, a requirement that a single individual be in control of a drone, and that drones not overfly individuals not directly involved in the work of the vehicle. The proposal would sharply limit the use of commercial drones in densely populated areas, and would require operators to pass an FAA test.