The Drone Threat to America’s Cities

This past March, the FBI warned state law enforcement that Iran might be planning to attack targets in California using drones launched from vessels floating offshore. As it turned out, the threat wasn’t real. The warning was based on “unverified” intelligence, and there was no evidence of an actual plot. Californians could breathe a sigh of relief.

But we shouldn’t get too comfortable. While the FBI might have been wrong about the specific Iranian plot, the threat of a serious drone attack is growing. And we’re not even remotely prepared for it—or the public panic that would likely ensue.

The FBI’s warning came to mind when I was in Ukraine recently as part of a delegation with the Renew Democracy Initiative to meet with senior Ukrainian government and military officials, drone manufacturers, and defense technology companies. While there, our delegation saw firsthand how the Ukrainians have used drone warfare asymmetrically against the Russian Army and ground President Vladimir Putin’s war of aggression to a bloody standstill.

Few expected this when Putin launched his invasion four years ago. At the time, most intelligence and military analysts believed that Russia—a nuclear-armed country with a powerful military, five times the population, a much bigger economy, and China’s backing—would easily overwhelm Ukraine in a matter of days or weeks. As recently as 2025 and as President Trump famously put it, Ukraine still supposedly didn’t have the “cards” to resist Russia. But Ukraine has doggedly held on and is arguably turning the tide of the war in its favor, in large part by mass-producing millions of cheap drones and using them to wreak deadly havoc on the Russian war machine. Russia has suffered over 1.3 million casualties on the battlefield, its oil refineries and other infrastructure are in flames, and Moscow itself is now subject to Ukrainian drone attacks.

Unfortunately, the Ukrainians aren’t the only ones who’ve figured out how to produce cheap drones and use them to deadly effect against a theoretically more powerful adversary. Iran is, of course, doing this in the Persian Gulf—using its Shahed drones to restrict passage through the Strait of Hormuz. And if the FBI’s alert from March 2026 has any kernel of truth to it, Iran may have contemplated a drone attack on the U.S. homeland.

Could Iran have launched Shaheds at targets in California from vessels floating offshore, as the FBI warned? Maybe, although it would have been challenging for Iranian agents to smuggle the Shaheds and launchers to North America, load them onto vessels in a port, and then get them into position offshore—all without the complex plot being foiled or detected by bystanders, law enforcement, customs, border, or Coast Guard authorities.

But make no mistake, a few dozen Shaheds launched from fishing trawlers 15 miles offshore would do serious damage. Traveling at 115 mph, Shaheds could hit targets near the coast—for instance, three of Los Angeles County’s four oil refineries—in about 10 minutes. The results could be devastating: death and destruction, environmental damage, toxic plumes over urban areas, and severe fuel shortages that would hammer the Golden State’s economy. The drones would fly below radar coverage, making them hard to detect—and neither California’s coastline nor the refineries are defended with the kind of interceptors Ukraine uses to block 95 percent of the Shaheds that Russia launches every day. Under current law, only the military is allowed to have that kind of capability—and it’s unclear whether military bases in California would actually have the ability to intercept several dozen Shahed drones just minutes away from hitting their targets.

And oil refineries aren’t the only infrastructure that’s vulnerable in California. There’s also the power grid, Los Angeles International Airport (LAX), or the Ports of Los Angeles and Long Beach, where 40 percent of all oceangoing containerized trade enters the U.S., along with most of the oil imported from the Middle East or brought from Alaska to supply California’s economy. As Port of LA Executive Director Gene Seroka noted at the time of the FBI’s warning about the supposed Iranian plot, “these ports, airports and utilities are soft targets for the bad guys.” And the same could be said for coastal cities and infrastructure in other parts of the United States and around the world, such as the dense network of oil and gas infrastructure in Texas, Louisiana, and Mississippi along the Gulf Coast or major seaports like the Port of New York and New Jersey, Charleston, or Rotterdam in the Netherlands.

As bad as all that sounds, though, an Iranian Shahed attack on major cities or critical infrastructure isn’t the most likely nightmare scenario. In Ukraine, most of the carnage on the battlefield is inflicted by small, inexpensive quadcopter First-Person View (FPV) drones similar to what you might buy on Amazon, but armed with grenade-sized explosives and capable of kamikaze-style attacks on soldiers or vehicles. Last year, Ukraine produced 4 million FPVs, and it expects to make another 7 million this year. The drones are assembled from commercially available and 3D-printed components in hundreds of nondescript office buildings around Kyiv, Kharkiv, and other parts of the country. Ukrainian soldiers “pilot” the FPV drones remotely by looking through virtual reality glasses or at computer screens while sitting miles away from the so-called kill zones.

These cheap, mass-produced drones have transformed 21st century warfare, and terrorist groups such as ISIS and Hezbollah, as well as violent far-right extremists, have taken notice. Indeed, ISIS pioneered the use of cheap armed drones during the Iraqi fight to retake Mosul in 2016-2017, and Hezbollah has used FPV drones against Israeli troops in Lebanon.

Could terrorists fly FPV drones into spectators enjoying a Dodgers game or the opening ceremony for the 2028 Olympics? Voviette Morgan, in charge of security for the LA28 Olympics, thinks so. Last year, she warned the House Homeland Security Committee that “the persistent threat of unmanned aircraft systems has surged in recent years to make the detection and mitigation of drones one of the overarching concerns for any sporting event.”

Or consider a terrorist group replicating Russia’s grisly “Human Safari” in Ukraine-held Kherson, where Russian troops across the Dnipro River use FPV drones to hunt and kill Ukrainian civilians at random, like a drone-era version of the 2002 Washington-area sniper attacks. During a tense period in October 2002, two men—John Allen Muhammad and Lee Boyd Malvo—traveled around the D.C. area in a blue 1990 Chevrolet Caprice and used a sniper rifle to shoot random people doing ordinary everyday things, including buying gas, walking in store parking lots, or simply mowing their lawns. During their three-week rampage, the snipers killed 10 and wounded three others. What if a terror group decided to do something similar with kamikaze drones instead of sniper rifles—attacking people, say, walking down Rodeo Drive in Beverly Hills, shopping at the Grove outdoor mall near the Farmers Market in Los Angeles, enjoying Dungeness crab at Fisherman’s Wharf in San Francisco, or riding the carousel on the National Mall in Washington, D.C.?

These scenarios may sound like the plot of a 1970s-era disaster movie like “Black Sunday,” but the realities of drone warfare in Ukraine—and the easy and legal accessibility of inexpensive drones to anyone—make the threat too plausible to disregard. A determined group of attackers with a bunch of cheap FPV drones armed with explosives would be hard to stop, and it would paralyze a city with widespread panic, as happened to the D.C. area during those surreal and terrifying few weeks in October 2002 when the Washington snipers were on the loose.

I remember that feeling vividly. I was there. One of the random shootings—of FBI analyst Linda Franklin—took place in the parking lot of a Home Depot just minutes from my home in Arlington, Virginia. I’d been to that Home Depot many times and had parked in that same parking lot. Linda Franklin’s husband—William Franklin—testified during John Allen Muhammad’s trial that he was loading a shelf he’d bought into their car when he suddenly heard a loud noise and felt something hit the side of his face. It was his wife’s blood. She’d been shot and killed while standing by the car’s trunk, making sure their shopping cart didn’t roll away. Chilling … and totally random.

I was in the government at the time, advising the head of an agency that would soon be absorbed into the Department of Homeland Security. I was paid for reasoned analysis and strategic thinking. But during those three weeks in October 2002, I was as frightened and panicked as anyone else. Like everyone I knew, I took cover behind my car when I got gas, and I didn’t linger outside my front door. And without any doubt, the same kind of primal panic would grip the public if terrorists started using kamikaze drones to attack people randomly at outdoor malls, at sporting events, in public parks, or on city streets.

What could be done to respond to that kind of drone attack? Not much, at least initially. When I served in the Obama administration as assistant secretary of homeland security, I oversaw the Department of Homeland Security’s counter-drone policy. And for a while, my marching orders were actually to avoid taking on the issue under the department’s purview and instead push responsibility for it onto the Federal Aviation Administration (FAA) or another federal agency. Why? Because there were no good solutions for the drone threat. The Department of Homeland Security didn’t have the right personnel in the right places; it had no authority to direct state and local forces, and the tools for actually stopping a drone attack didn’t really exist. So, the department tried to avoid being held responsible for this seemingly unsolvable problem by playing a bureaucratic version of touching its nose and saying, “Not it!”

The challenge hasn’t gotten any easier. For one, the U.S. doesn’t track all the drones in the sky. The FAA requires most drones to be registered and to broadcast a “Digital ID” along with their location and altitude. But the rules only require broadcasting by radio frequency (RF)—not cellular internet—which inherently limits the tracking range. While it might theoretically be possible to deploy a vast network of ground RF sensors across a metropolitan area, doing so would be extraordinarily expensive and practically useless for broad defense. At most, such counter-unmanned aircraft system (C-UAS) sensors are deployed to protect ultrasensitive, discrete locations, such as major airports or specific events such as the Super Bowl, where law enforcement is concentrated and authorized to respond. But C-UAS detection systems are not deployed to protect schools, public parks, or outdoor malls where people gather daily.

Think about the sheer volume of “noise” in the skies. According to the FAA, there are over 837,000 registered drones in the United States, with at least 12,500 in Los Angeles County alone. Even conservatively assuming only 150 registered drones are airborne across LA County at any given moment, how would authorities distinguish a legitimate commercial or hobbyist drone flight from a lethal threat before the final, fatal seconds? And that’s just the registered drones. Actual enforcement of the FAA’s drone registration laws is minimal, and smaller drones don’t need to be registered. So, in reality, the actual number of drones in the sky at any given moment is far, far greater.

Moreover, terrorist FPV pilots won’t be standing on street corners conspicuously wearing VR goggles. Like the Ukrainian pilots, they could be operating out of a basement miles away. It took an intense three-week manhunt involving nearly 1,000 police officers to catch the Washington snipers, who were traveling around the D.C. area in a blue sedan and sleeping at rest stops. The terrorist drone pilots could remain entirely invisible and be much harder to find. Even if an RF-controlled attack drone were detected via C-UAS sensors (a big “if”) and its control signal back-tracked to a location, a sophisticated attacker would have simply followed Peter Clemenza’s famous command in “The Godfather”: “Leave the gun, take the cannoli.” They would have dropped the controller and vanished into the urban landscape long before police arrived.

We can designate “no-drone zones” over major events like the FIFA World Cup or LA28 Olympics, but how do police respond when a drone actually breaches that airspace? It often happens by accident, and separating the signal from the noise is nearly impossible. During the Paris Olympics in 2024, French security forces intercepted 90 drones and arrested 85 drone pilots—most of these were clueless “tourists unaware of the regulations.”

While electronic jamming or geofencing might work to bring FPV drones down or prevent them from entering a restricted area, modern drone tactics and technology are rapidly outgrowing jammable radio frequencies. In Ukraine, both sides have developed countermeasures to thwart the electronic jamming of FPV drones. One way is by tethering the drones to their controllers via spools of ultrathin fiber-optic cable—sometimes stretching up to 20 kilometers—so the drones can communicate with human pilots without using radio frequency at all. Hezbollah uses the fiber-optic cable technique against Israeli forces in Lebanon. The Israel Defense Forces have reportedly “so far been unable to develop any effective countermeasures” to Hezbollah’s fiber-optic drones. Alternatively, an attacker can use fully autonomous, artificial intelligence-driven navigation and target selection. Once launched, these autonomous drones require no external communication link whatsoever. No signal means there’s nothing to jam. In short, the focus on how to electronically jam drones may be fighting the last war.

But even if the FPV drones could be brought down by electronic jamming, it’s unlikely that local authorities would have the equipment readily available. Indeed, state and local authorities were strictly prohibited under federal law from using electronic jamming equipment until late 2025, when Congress finally changed the law. Private-sector infrastructure owners are still banned from doing so. And even under the new law (the SAFER SKIES Act), local authorities still can’t use jamming technology until they’re trained and certified by the Department of Justice pursuant to regulations that haven’t been finalized yet. So, even if electronic jamming could bring down the attack drones, there is little capability to do so yet.

In sum and as G.B. Jones, the chief safety and security officer for FIFA World Cup 2026, has stated bluntly regarding the drone threat: “We don’t have the training, we don’t have the equipment, and we don’t have the number of personnel that are skilled in mitigation technology and the use of mitigation technology, particularly the application of that technology in really highly dense radio frequency environments or urban environments.”

In the meantime, and until we figure out a better answer, get ready for U.S. and European cities to start looking like parts of Kharkiv or other areas I visited recently in eastern Ukraine—with outdoor malls, concert venues, public parks, shopping streets, and other areas draped with anti-drone netting cut from fishing nets, installed to ensnare quadcopter drone blades, and protect people and vehicles from attack.

Draped fishing nets would be tragic aesthetics for beautiful cities like Los Angeles, New York, San Francisco, or London. But until we fast-track federal certifications, deploy scalable detection, and innovate past the era of electronic jamming to address the threat presented by fiber-optic or AI-piloted drones, netting may become the inevitable protective measure demanded by insurers and lawyers alike, let alone the general public and panicked politicians. To avoid that ugly reality, we need to come up with better ideas, and we need them fast. Because ready or not, the drones are coming.