On May 6, the Federal Aviation Administration (FAA) published a long-awaited Notice of Proposed Rulemaking, establishing a process by which critical infrastructure entities can obtain flight restrictions for unmanned aircraft systems (UAS) above their facility. Known as the "2209 Rule" because it implements a decade-old requirement in Section 2209 of the FAA Extension, Safety and Security Act of 2016, the proposed rule defines eligibility criteria for each of 16 critical infrastructure sectors; the scope of available protections; and the process for obtaining restrictions.
Under current rules, private sector entities must work through a government sponsor to obtain a flight restriction over their facility. The 2209 Rule, once final, will greatly simplify the process—enabling qualified critical infrastructure entities to obtain those restrictions directly from the FAA. The FAA is accepting comments on the proposed rule until July 6, 2026.
Proposed Rule Eligibility Criteria
Under the proposed rule, applicants need to be a fixed site (not mobile) and critical infrastructure, as the term is defined in 42 U.S.C. Sec. 5195c(e); have their own protective security measures already in place; specify critical assets or components that are vulnerable to drone-related threats; and demonstrate that damage to, disruption to, or destruction of the facility would have a regional or national-level debilitating impact. 14 CFR Sec. 74.54.
The proposed rule sets specific criteria that applicants must meet from within the following categories of critical infrastructure:
- chemical
- commercial facilities
- communications
- critical manufacturing
- dams
- defense industrial base
- emergency services
- energy
- financial services
- food and agriculture
- government services and facilities
- healthcare and public health
- information technology
- nuclear reactors, materials, and waste
- transportation systems
- water and wastewater systems
Criteria are specific to each sector, some of which are broad, some narrow. The "emergency services sector," for example, is limited to correctional facilities only. 14 CFR Sec. 74.87. And eligible commercial facilities are limited to those that have annual attendance of 2.5 million in the previous year, are open to the public for at least 120 days a year, and are primarily outdoors—thus excluding many high-profile events where large numbers of people gather. 14 CFR Sec. 74.82. The FAA is seeking specific feedback about criteria for certain sectors, including the critical manufacturing, emergency services, financial services, food and agriculture, and water and wastewater systems.
Scope of Flight Restriction: Unmanned Aircraft Flight Restrictions (UAFRs) and Special UAFRs
The proposed rule envisions two types of flight restrictions: Standard UAFRs and Special UAFRs. Both include defined horizontal and vertical limits around an eligible site and are generally subject to an altitude ceiling of 400 feet. Violators are subject to civil and criminal enforcement actions.
Standard UAFRs include certain allowable exceptions for approved drone operations, whereas Special UAFRs restrict all drone operations unless expressly permitted by the FAA or site operator. Special UAFRs are generally limited to sites that are operated or sponsored by a federal security or intelligence agency, the Department of War, or the Department of Energy. Both categories of UAFR can be active continuously or part-time, with part-time defined as active for up to 290 consecutive days per year, providing flexibility for site operators with seasonal needs.
Process for Acquiring UAFRs
Pursuant to the proposed rule, the FAA would create a website portal for UAFR applicants to submit requests and supporting information. If conditionally approved, the FAA would publish the proposed UAFR in the Federal Register for notice and comment for a minimum of 30 days. UAFRs would be subject to public notice and comment, absent a good cause basis for forgoing notice and comment. UAFRs can be granted for a term of up to five years before requiring renewal.
Other Counter-UAS-Related Developments
In April, Senator Cotton introduced the Critical Infrastructure Airspace Defense Act, which would provide trained operators and owners of covered critical infrastructure facilities the authority to engage in approved counter-UAS mitigation measures to protect their facilities. Covered critical infrastructure facilities are defined as those designated by the secretary of homeland security, in consultation with the secretary of energy, as a high-risk site, including, at a minimum, nuclear generating stations, key substations, transformer stations, and control centers of the bulk power system.
Separately, the FAA recently announced its new Drone Expedited and Targeted Enforcement Response (DETER) Program, a new enforcement initiative aimed at addressing certain first-time operational violations of UAS regulations through streamlined administrative processes.
How Venable Can Help
If you have questions about these developments, what they could mean for your organization, or whether and how to provide input regarding the proposed 2209 Rule, please reach out to Jennifer Daskal.
The author would like to thank Frances Schroeder, Senior Cybersecurity Services Analyst, for her assistance with this article.