LC-1 · Kinematic Threat Briefs

Kinematic Threat Brief

# Kinematic Threat Brief

**LRRK Watch / Open-Source Intelligence** — Five current signals across systems that sense, move, and act.

| Field | Value |
| --- | --- |
| Collection cutoff | 31 May 2018 |
| Platform | Quiet Systems |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |

## Executive read

### BLUF

May made COTS unmanned Sense a department-wide trust failure: the DoD Inspector General found no adequate process to assess commercial-off-the-shelf UAS cyber risk (14 May), and a 23 May DepSecDef-level memo — circulating by month's end in the trade press — suspended COTS UAS purchase and operational use pending a mitigation strategy.

### Key judgments

1. **[Assessment — high confidence]** The 14 May 2018 DoD IG finding, as quoted in the subsequent FOUO memo published by sUAS News, is that DoD "has not implemented an adequate process to assess cybersecurity risks associated with using commercial-off-the-shelf (COTS) Unmanned Aerial Systems."
2. **[Assessment — high confidence]** DOT Secretary Elaine Chao announced ten UAS Integration Pilot Program selectees on 9 May, creating a parallel civil authorization experiment the same month DoD moved to freeze COTS UAS.
3. **[Inference — moderate confidence]** The Army's 2017 DJI-only cease-use order has been overtaken by a department-wide COTS freeze: the trust failure is now process, not a single Chinese brand.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. DoD IG — no adequate COTS UAS cyber-risk process

*Event / publication dates: IG finding 14 May 2018; memo text circulated and published 7 June 2018 by sUAS News (May event, June publication stated)*

**Verified record — [Fact — B1]** sUAS News published the unclassified/FOUO memorandum titled "Unmanned Aerial Vehicle Systems Cybersecurity Vulnerabilities." The body states: on 14 May 2018 the DoD Inspector General found that DoD has not implemented an adequate process to assess cybersecurity risks associated with using COTS UAS; "effectively immediately" addressees must suspend purchases of COTS UAS for operational use until DoD develops a strategy to assess and mitigate the risks, and must suspend use of COTS UASs until DoD identifies and fields a solution to mitigate known cybersecurity risks; exemption approval is held at the memo's signatory, case by case, for urgent needs; POCs named are Ellen M. Lord (USD A&S) and Dana Deasy (DoD CIO). Trade reporting dates the memo 23 May. Fetched: https://www.suasnews.com/2018/06/us-dod-pulls-the-plug-on-cots-drones/

**Threat landscape.** Every COTS Sense node in DoD inventory is now presumptively untrusted until a department strategy exists. Trust boundary is purchase + use + exemption, not just DJI.

**Intelligence assessment.** [Assessment — high confidence] The IG finding is 14 May; the freeze language is in the fetched memo text. [Inference — moderate confidence] The freeze covers DJI and non-DJI COTS alike. [Uncertainty] Signatory block on the image/memo as first published is FOUO; this filing uses the quoted body only.

**Opportunity.** The official DoD IG report PDF on a .mil host.

**LRRK relevance.** Control Fabric / Passport / Watch. Record: 14 May IG, COTS purchase/use suspend, Lord/Deasy POCs, case-by-case exemptions.

**Confidence.** High on the finding and freeze text; moderate on exact 23 May signature date as trade-attributed.

## 02. DOT names ten UAS Integration Pilot Program selectees

*Event / publication dates: 9 May 2018 DOT release*

**Verified record — [Fact — A1]** U.S. Transportation Secretary Elaine L. Chao announced ten state, local, and tribal governments as IPP participants: Choctaw Nation of Oklahoma; City of San Diego, CA; Virginia Tech / CIT, Herndon, VA; Kansas DOT; Lee County Mosquito Control District, FL; Memphis-Shelby County Airport Authority; North Carolina DOT; North Dakota DOT; City of Reno, NV; University of Alaska-Fairbanks. USDOT/FAA evaluated 149 proposals; the ten will refine concepts through MOAs; "no federal funds will be spent on the program." Concepts include night, BVLOS, package delivery, and "the reliability and security of data links." Fetched: https://www.transportation.gov/briefing-room/dot3419

**Threat landscape.** Civil unmanned Act is being designed as local-government + private USS partnerships. The same month DoD freezes COTS, DOT is paying in authorization (not dollars) for more complex operations.

**Intelligence assessment.** [Assessment — high confidence] Ten selectees are public. [Inference — moderate confidence] Data-link security is named because it is an acknowledged gap. [Uncertainty] MOA texts not fetched.

**Opportunity.** The first signed IPP MOA.

**LRRK relevance.** Control Fabric / Lab. Passport the ten jurisdictions and the 149-proposal funnel.

**Confidence.** High on the list.

## 03. Army DJI memo is now the narrower ancestor of a COTS freeze

*Event / publication dates: 2 August 2017 Army memo; 14–23 May 2018 department action*

**Verified record — [Fact — B1]** Defense One's 2017 report of the Anderson cease-use order (DJI products and DJI components/software; 300+ AWRs) is the service-level predecessor. May's IG/memo language is brand-agnostic COTS. Fetched: https://www.defenseone.com/technology/2017/08/us-army-just-ordered-soldiers-stop-using-drones-chinas-dji/139999/ and https://www.suasnews.com/2018/06/us-dod-pulls-the-plug-on-cots-drones/

**Threat landscape.** Brand-specific cyber fear has become a process finding. Substituting a non-DJI COTS type does not, on the memo's text, restore purchase authority.

**Intelligence assessment.** [Assessment — high confidence] Scope widened from DJI to COTS. [Inference — moderate confidence] Units that already grounded DJI now lack a published approved alternative. [Uncertainty] Exemption traffic in May not fetched.

**Opportunity.** First published urgent-need exemption.

**LRRK relevance.** Passport / Control Fabric.

**Confidence.** High on scope change.

## 04. Triton induction path — Guam promise still live

*Event / publication dates: Sea-Air-Space 10 April 2018 Guam-by-year-end; May induction reporting in later Navy accounts*

**Verified record — [Fact — B2]** The 10 April USNI/NAVAIR claim that first operational MQ-4C Tritons deploy to Guam by end-2018 is still the public calendar. Later Navy/USNI accounts date a 31 May 2018 induction into service; that specific May 31 sentence was not on a page fetched as a May 2018 primary in this collection and is graded cautiously. Fetched (April announcement still governing): https://news.usni.org/2018/04/10/navy-first-operational-mq-4c-tritons-will-deploy-guam-years-end

**Threat landscape.** HALE maritime Sense is being declared ready on a 2018 clock that has not yet survived a mishap.

**Intelligence assessment.** [Assessment — high confidence] Guam-by-December remains the April plan. [Uncertainty] Precise 31 May induction wording not independently fetched as a May HTML.

**Opportunity.** A NAVAIR 31 May induction release.

**LRRK relevance.** Campaign / Watch.

**Confidence.** High on the plan; moderate on the induction date as later-attributed.

## 05. LAANC wave two — civil authorization still expanding under the IPP shadow

*Event / publication dates: April first wave; monthly regional additions through 2018*

**Verified record — [Fact — B1]** Aviation Today's later completion story records monthly regional additions after the April Central South start. May is inside that wave sequence. USS model: Harris, Airmap, Project Wing, Thales, Skyward as of the September piece. Fetched: https://www.aviationtoday.com/2018/09/20/laanc-available-around-us/

**Threat landscape.** Near-real-time authorization increases legal Part 107 density near airports without solving unauthorized or foreign-app C2.

**Intelligence assessment.** [Assessment — high confidence] Rollout is underway in May. [Inference — moderate confidence] IPP and LAANC together are the civil Control Fabric; the DoD freeze is the military one. [Uncertainty] May airport increment not separately tabulated in the fetched article.

**Opportunity.** FAA May wave map.

**LRRK relevance.** Control Fabric / Watch.

**Confidence.** High on continuation; moderate on May counts.

## Forward indicators

Ranked watchlist as of the collection cutoff (what a Watch desk would have monitored next).

1. Official posting of the COTS UAS freeze memo on a .mil host and first exemptions.
2. IPP MOAs — especially data-link security clauses.
3. Whether the COTS freeze is implemented as DJI-only in practice.
4. Triton induction paperwork and Guam bed-down.
5. MQ-25 award and any new cheap-UAV raid.

> **Collection integrity.** IG/memo text from the sUAS News 7 June page actually fetched; the 14 May finding and 23 May memo dates are in that text/attribution and are used for May with the June publication date stated. DOT IPP from the 9 May transportation.gov page actually fetched. Army DJI from Defense One actually fetched. Triton induction-on-31-May is not treated as A1. Venezuela, Gatwick, and the August MQ-25 award were not back-dated.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C1</span></p>