Who Secures the Traffic Lights in the Sky?
As India builds a national drone traffic management system, cybersecurity will be critical to keep our skies safe.
We secured the roads. We secured the airports. Now we may have to secure the sky itself.
I came across an interesting development this morning.
India is moving towards a national Unmanned Aircraft Systems Traffic Management (UTM) system for drones operating in low-altitude airspace.
Think of it almost like air traffic control for drones.
As thousands of drones eventually move across our cities - for deliveries, agriculture, infrastructure inspection, surveillance, emergency response and perhaps one day autonomous passenger movement - we cannot have every drone simply deciding where it wants to fly.
The proposed ecosystem is intended to bring things such as flight permissions, geofencing, traffic coordination and situational awareness into a highly automated digital environment, integrated around platforms such as DigitalSky.
From a technology perspective, this is fascinating.
When the control plane becomes the target
But the cybersecurity person in me immediately had another thought.
What happens when the traffic management system itself becomes the target?
Imagine the possibilities.
An attacker doesn’t necessarily need to hijack a drone.
Compromise the system that tells thousands of drones where they are allowed to fly, and the problem becomes much bigger.
Manipulated location data. Fake flight authorisations. Compromised drone identities. GPS/GNSS spoofing. API attacks. False collision information. Or simply denying legitimate drones access to the airspace during an emergency.
From an IT platform to a digital control plane
That means we are no longer protecting only an IT platform.
We are protecting a digital control plane connected to physical movement in the real world.
And that changes the consequence of a cyberattack.
A compromised database affects information.
A compromised drone-traffic ecosystem could potentially affect machines moving through physical space.
Security from Day Zero
For me, therefore, cybersecurity needs to be designed into this architecture from Day Zero - not added after the system becomes operational.
Strong machine identity. Zero-trust APIs. Cryptographically trusted commands. Continuous telemetry monitoring. Spoofing and anomaly detection. Segmentation and resilience. And critically, a safe way to continue operating when the digital control plane itself cannot be trusted.
The more important challenge
India’s drone ecosystem will undoubtedly grow.
Building the digital highways in the sky is the next logical step.
But as we build traffic rules for machines above our cities, we also need to make sure nobody else can rewrite those rules.
That may ultimately be the more important challenge.
Instincts built hunting signals at sea, sharpened for two decades against digital adversaries. Not machine-written. Machine-proofread, comma by comma. Everything else, the noticing, the arguing, the getting it wrong sometimes, is mine. The bytes are for everyone; the opinions are only ever mine.
“Until the lion learns how to write, every story will glorify the hunter.” This is the lion's version.