Ten years ago, Congress passed Section 2209 of the FAA Extension, Safety, and Security Act.  That provision required the FAA to establish a process for private owners of critical infrastructure to prevent drone flights near their property.  Unsatisfied with the FAA’s progress, in 2018, the Congress gave the FAA explicit instructions to publish a Notice of Proposed Rulemaking (NPRM) by March 31, 2019, with a final rule released no later than May 31, 2020.  Needless to say, this deadline was not met.

Finally, after nearly a decade of waiting, the FAA has finally released its Section 2209 NPRM.  The proposed rule defines Critical Infrastructure as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating effect on security, national economic security, national public health or safety, or any combination of those matters.”  This specifically includes facilities such as critical manufacturing, dams, the defense industrial base, energy production and transmission, and nuclear reactors, materials, and waste. 

If the owner of the infrastructure is able to demonstrate that a flight restriction is necessary for aviation safety, protecting people and property on the ground, national security, or homeland security, then the FAA will issue an Unmanned Aircraft Flight Restriction (UAFR) for the area.  However, the FAA made clear that it intends to “limit UAFR eligibility to balance the safety and security concerns Congress identified in section 2209 with the national policy objectives of ensuring the public right of transit, preserving airspace efficiency, and integrating UAS into the NAS.”

The FAA proposes two categories of UAFR, a “Standard UAFR” and a “Special UAFR.” For the Standard UAFR, if the drone is operated under applicable Federal Aviation Regulations, such as Part 91, Part 107, the proposed Part 108, Part 135, or Part 137, the aircraft will be permitted to “transit” over the UAFR area so long as it broadcasts a remote ID signal and provides the site owner with notification of the flight.  The UAS operator does not have to request permission from the FAA or the site operator.

For the Special UAFR, drones are only permitted to enter the restricted area with the express permission of the site owner.  The Special UAFR designation is only available to highly sensitive facilities, generally requires an endorsement from a federal defense or security agency, and must be “supported by a security assessment demonstrating credible risks,” and the request for such a designation will be required to go through a public notice and comment period before being granted.

The FAA intends to create a web portal for applicants to submit supporting information showing that the facility meets the eligibility criteria and that there is a safety or security need for the restriction.  In addition to showing why the facility is sensitive, the operator must show that the facility has layered physical security and protection, security personnel, and the ability to receive remote ID broadcasts.  UAFRs are effective for 5 years and can be renewed by the site operator or owner. 

The NPRM does not establish any new penalties for violation of the UAFR, instead relying on existing penalties and enforcement mechanisms under part 91 or part 107.  In addition, willful violations of a UFAR can be considered a violation of national defense airspace under 49 U.S.C. § 46307, which is punishable by up to 1 year in prison. 

The proposed rule does not authorize the site owner to use counter-drone technology, although it does not prohibit the use of such technology if the site owner is authorized to do so under other statutes or regulations. 

While the NPRM clearly falls into the “better late than never” category, it is disappointing some critical infrastructure operators.  Many people assumed that the designation would create a clear “no fly zone” around their facility.  Instead, the airspace over standard UAFRs generally remains open to all except hobbyists or unlicensed flyers.  Conversely, commercial UAS operators are already posting comments warning that over-designation of UAFRs will create a balkanized patchwork of navigable airspace that will make compliance difficult.  We will all have to wait and see how the FAA threads this needle in the final rule. 

The FAA set a 60-day public comment period for the proposed rule, which expires July 6, 2026.  Comments can be submitted at https://www.regulations.gov/document/FAA-2026-4558-0001.