DOJ and DHS Issue Interim Final Rule on State and Local Counter-Drone Authority Under the SAFER SKIES Act

I. Overview

On July 6, 2026, the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland Security (DHS) published an Interim Final Rule (IFR) setting up a new federal framework that allows state, local, Tribal, and territorial (SLTT) law enforcement and correctional agencies to detect, track, and, in some cases, disable or seize drones. The rule directly affects SLTT agencies looking to stand up counter-drone programs, as well as drone and counter-drone technology companies whose products will be subject to federal review and approval. Although the IFR bypassed the Administrative Procedure Act’s standard notice-and-comment process on good cause grounds — citing the statutory 180-day deadline and urgent public safety needs — the rule is already legally binding and effective as of July 1, 2026. The Departments are nonetheless accepting post-promulgation comments through September 4, 2026.

II. Background

The SAFER SKIES Act, enacted by Congress in December 2025 as part of the FY2026 National Defense Authorization Act, expanded counter‑UAS authorities by allowing properly trained SLTT law enforcement and correctional agencies operating under federal safeguards to detect, track, and, in limited circumstances, disable or seize drones that pose a credible threat to people, facilities, assets, major events, critical infrastructure, or correctional facilities.

The IFR, published on July 6, 2026, lays out the rules SLTT agencies must follow to use these new authorities. It covers training and certification, approved technologies, spectrum and airspace coordination, reporting requirements, privacy safeguards, and enforcement. Key provisions are summarized below.

III. Key Provisions

• Two-Tier Authorization Framework. The rule creates two levels of counter-drone authority. Tier 1 (“Detection and Warning”) authorizes agencies to take actions described in  6 U.S.C. § 124n(b)(1)(A)-(B), including detecting, identifying, monitoring, or tracking drones, and warning drone operators. It has lighter requirements and no mandated in-person training. Tier 2 (“Mitigation”) authorizes agencies to take actions described in 6 U.S.C. § 124n(b)(1)(C), (D), or (F), including disrupting, seizing, or exercising control of, or using reasonable force, if necessary, but requires hands-on training at the FBI’s National Counter-UAS Training Center (NCUTC). Personnel with only Tier 1 certification cannot take any Tier 2 action, even in an emergency.
• Training and Certification. The FBI’s NCUTC is the only authorized certifying body, and training from any other source does not meet the rule’s requirements. Tier 1 (Detection and Warning) certification is completed online and issued automatically once the assessment is passed. Tier 2 (Mitigation) certification requires in-person training at the NCUTC. No counter-drone operations can begin until personnel hold the right certification.
• Authorized Technologies and Systems. The IFR creates two lists. The Authorized Technologies List identifies approved categories of counter-drone technology. The Authorized Systems List identifies specific products that have passed a multi-agency review by DOJ, DHS, DoD, FAA, FCC, and NTIA. Once specific products are listed for a given category, agencies must use only those listed products. Until then, agencies may use any product in an approved category, as long as the operator has Mitigation Certification and has completed the manufacturer’s training on that system. For manufacturers, getting on the Authorized Systems List will be critical to market access.
• Spectrum Authorization. Any SLTT agency or vendor deploying a counter-drone system that emits radio frequency (RF) signals for detection or mitigation must get FCC authorization before turning it on. This process can take time, so agencies and vendors should start early in their procurement planning.
• FAA Coordination and Air Traffic Control (ATC) Notification. Before starting any mitigation operation, agencies must coordinate with the FAA through a designated federal portal. Once a mitigation system is activated, agencies must notify air traffic control within five minutes (or as soon as practically possible) and again when the action ends. ATC notification is also required for non-RF mitigation actions unless FAA procedures say otherwise.
• Operational Governance. Every counter-drone operation requires a C-UAS Operations Plan on a standardized federal form, signed by a senior agency official and certified by the agency’s legal counsel or, for agencies without in-house counsel, the applicable prosecuting authority. For mitigation operations, agencies must file advance notice through an FBI portal at least 30 days before the operation and submit the Operations Plan at least 7 days before it begins. A post-operation report is due within 48 hours of any mitigation action, confiscation, or end of a notified operation.
• Privacy Protections. Agencies must follow First and Fourth Amendment requirements, minimize data collection, and configure systems to avoid capturing non-drone communications. Intercepted communications must be deleted within 180 days unless a documented exception applies (such as an ongoing criminal investigation or active litigation). Data kept under a security exception must be reviewed every 90 days. Agencies must also maintain a searchable audit trail for at least six years.
• Compliance and Penalties. Agencies or individuals who knowingly skip required federal coordination steps, such as advance notification, real-time ATC notification, or post-action reporting, can face fines of up to $100,000 per violation or have their counter-drone authority suspended. Penalties are scaled based on severity. A first procedural violation will not result in a penalty if the agency shows good-faith compliance and self-reports. Other types of violations are handled through compliance audits and certification suspension.

IV. Key Takeaways and Action Items

1. File Comments by September 4, 2026. DOJ and DHS are accepting public input on privacy protections, technology list criteria, the penalty structure, and other policy choices. This is a meaningful opportunity to provide industry feedback for consideration as the agencies develop the final rule, particularly for manufacturers seeking clarity on the product approval process.
2. Begin Certification Planning Now. Tier 1 (Detection and Warning) certification can be done online. Tier 2 (Mitigation) certification requires in-person training at the NCUTC, which may have limited capacity. Agencies should enroll as soon as possible.
3. Secure FCC Spectrum Authorization Early. Any agency or vendor deploying an RF-emitting counter-drone system needs FCC authorization before it can be used. The authorization process can be lengthy, so start early.
4. Prepare Operational Documentation. Agencies need a signed and legally reviewed C-UAS Operations Plan submitted at least 7 days before operations begin. For mitigation operations, advance notice must be filed at least 30 days ahead.
5. Update Privacy and Data Policies. Intercepted communications must be deleted within 180 days unless a narrow exception applies (with documented justification and 90-day reviews). Agencies must maintain a searchable audit trail for at least six years.

Crowell & Moring will continue to monitor these developments. For further information, please contact our team.