Please also read the updated (January 12th and 14th) post about how the NPRM de facto eliminates most indoor flight of small UAS as Remote ID prevents flying if there is no GPS signal and the FAA asserts in the NPRM that only Remote ID compliant UAS may be sold.

Short Summary

• Where Internet access is available, most flights of small UAS must be recorded, in real time, in an Internet database called a REMOTE ID USS.
• Separately, there is a Federal law named Childrens Online Privacy Protection Act (COPPA) that restricts the collection of data on children under age 13 (there is a bill in in Congress to raise that to under 16). This bill specifically includes geolocation data, and data collected from “toys and Internet of Things” devices as protected information on youth.
• These restrictions apply to businesses, government and government contractors. There is no exemption for the FAA.
• Even if they do not know they are collecting data on children, if a parent or guardian finds out after a flight that data has been collected, the parent has a legal right to request to review the data, request to delete the data and request to suspend further collection of the data. The FAA has no choice. Age restrictions on flight do not solve the problem as kids will still fly anyway and once notified, the REMOTE ID USS has to comply with COPPA.
• We end up with, then, the FAA mandating collection of geolocation data on children while simultaneously another law, COPPA, says they cannot do that. Both cannot be true simultaneously.
• This is a serious problem for the FAA’s NPRM and there are no obvious solutions within their current proposal. I propose a novel solution to eliminate most of the problems with Remote ID logging and COPPA and simplify the ease of compliance and costs for recreational flyers.

Background on COPPA

The FAA’s NPRM for remote ID of all small UAS includes a provision that where Internet access is available, all craft (except those < 0.55 pounds) must subscribe to and log their flight in real time, once per second, into an Internet database called a REMOTE ID USS.

I was tipped off by someone  in the legal field who says the mandatory collection of real time flight data – including of flights conducted by children – appears to conflict with a Federal law known as the Childrens Online Privacy Protection Act which restricts the collection of data on children under age 13. This law applies  to businesses, the Federal government and any contractors they use – there is no exemption for the government to collect data on children. It specifically restricts the collection of geolocation data and data provided by “toys and Internet of Things” connected devices.  Yet the FAA plans for an Internet-connected database tracking all flights, including by children, in an Internet database known as a REMOTE ID USS.

(My background is engineering, not law. However, when designing products or services, if I see possible legal issues, I document them and ask for legal assistance. This post is seeking feedback on these issues and my proposed technical solution .)

If a parent or guardian becomes aware that information has been collected about their child, including geolocation data, the parent or guardian is legally entitled to let the service know  – in this case, the REMOTE ID USS. Once notified, the parent is legally entitled to request to review the data, to request suspension of data collection and to request deletion of all collected data. (In effect, essentially anyone could spoof these requests and ask for deletion of data.)

The FAA could, say, ban flights by kids under 13 (Congress is considering raise the age to under 16) but that does not solve this problem. A child could take Mom’s quadcopter out to  the backyard and fly it. Once Mom discovers this, COPPA protections kick in – and she can request review, suspension or deletion of the data afterwards.

The FAA knew this in 2015 when they issued  a report on  registering all pilots of remote UAS. In that report, they stated they would not allow anyone under age 13 to register as they would then have to deal with COPPA, but they noted that children under 13 could still fly under the supervision of an adult who has registered.

What has changed is that under the Remote ID NPRM, the FAA would now be logging all flights by children, which runs into difficulties with COPPA requirements.

(I have pages of supporting quotes from the Federal Trade Commission that describe COPPA in details, and extensive notes on how this relates to the NPRM. The above is only a brief summary of the COPPA issues. This is a real problem for the NPRM.)

I could not identify a workable solution to the “COPPA dilemma” of the FAA logging a child’s geolocation data in real time without coming up with an alternative way of tracking aircraft.

This is the proposed concept I came up with to solve this problem and I am seeking feedback on this idea.

Proposed Technical Solution to the COPPA Restrictions on Data Collection

COPPA applies to the FAA’s anticipated collection of geolocation and personally identifiable information from children under age 13 (or 16) due to mandated requirements to log flight operations in a REMOTE ID USS database, if Internet is available.

Even if the data is collected without knowledge that the small UAS operator is a youth, if a parent or guardian learns of this, they have a legal right to notify the REMOTE ID USS operator and to request review, deletion and to refuse collection of any more such data.

This request, however, is easy to spoof and there is no foolproof way – in any practical, scalable sense – to prevent others from using this requirement to have data collection turned off or deleted.

Discussion of Alternative But Insufficient Solutions

The FAA could, during aircraft registration, state that no one under age 13 (or 16) may be allowed to operate the small UAS. This would be an obvious public relations mess for the FAA – banning kids from using small UAS. It would shut down youth aviation STEM programs . Further, if the age limit is raised to age 16, this has the oddity that children age 14 and 15 may legally pilot sailplanes and hot air balloons – but could not legally fly a toy airplane. This would be quite something – Civil Air Patrol cadets (minimum age 12) could pilot a sailplane at age 14 but could not legally fly a toy airplane until age 16.

Another possibility is to employ an age screen at time of each flight. However, this would be cumbersome, easily spoofed, and once a child has flown anyway, COPPA’s requirements remain in effect.

Thus, prohibiting flight by those under age 13 (or 16) does not resolve the problem as children will fly anyway, with or without parental supervision. When a parent learns of this, the parent has a legal right to request to review the data, delete the data and to refuse permission to collect anymore data.

So we have:

• FAA mandates data collection
• While COPPA says you cannot collect that data

Both laws/regulations cannot exist simultaneously.

Banning flight by youth does not fix this problem.

There may be a technical solution that largely meets all FAA requirements, however, which I detail.

The first step is to apply mandatory  REMOTE ID USS logging only to Part 107 operations – specifically automated drone fleets – and not for recreational flights.

Because one must be at least 16 years old to conduct Part 107 operations, this excludes data collection on any one under age 16, and fully complies with COPPA. (According to the FAA, “You must be at least 16 years old to qualify for a remote pilot certificate” (https://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=20516).

Require broadcast beacon ID’s only from recreational aircraft – and delete the direct Internet logging requirement, which appears to be in place to support automated drone fleets delivering packages. I am using the term “Beacon ID” to mean the one-way broadcast of Remote ID information “over the air”, presumably using FCC Part 15 authorized frequencies and modes.

Simple broadcast beacon IDs should be sufficient – but if there is a need to log flights in an Internet database,  then read on to the next section and see how this can be done without violating COPPA.

My solution greatly simplifies the burden on the recreational communities millions of small UAS.

Recommendation: A Technical Solution To Avoid Violating COPPA

Let us assume that recreational fleet aircraft use beacon-based Remote ID only. All recreational flights transmit their location and altitude in real time. This information may be received by other craft and used for collision avoidance or other purposes.

Automated and Part 107 drone fleets would receive the beacon-based Remote ID transmissions, including the location and altitude of recreational craft while their commercial craft are in flight. Because both aircraft would be “in the air” the transmission distance of these Beacons would be a maximized “line of sight” distance.

For the purposes of an air traffic control database, commercial drones may strip personally identifiable information from the beacon broadcasts received from recreational drones and relay the anonymized recreational beacon data (craft type, latitude, longitude, altitude) into the Internet cloud REMOTE ID USS. [Updated to add “received from recreational drones” – did not mean to imply stripping items from Part 107 beacons.]

By anonymizing the data, this data collection complies with COPPA.

Law enforcement would still have access to direct broadcast beacon Remote ID transmissions, including operator information. Law enforcement would have access to flight locations recorded in the cloud database for subsequent tracking of flights (assuming flight occurs while other Part 107 operations are in progress and relaying this information). Law enforcement could set up their own Beacon receivers at special events (such as a stadium event).

By submitting anonymized data into the cloud, this data could be used to provide air traffic management services to the Part 107 operators.

This solution places the cost of the air traffic management system on the specific users that benefit – the Part 107 operators flying automated fleets of aircraft.

In the event there are no Part 107 operations in the area to receive these Beacons:

1. This means small UAS airspace utilization is low and there is no need for automated air traffic management service.  Indeed, if there are no Part 107 operations underway, this means small UAS are most likely controlled by humans – which can and should take actions to avoid other craft in flight, as is done now by small UAS pilots.[1]
2. If in remote locations (most of the United States land mass outside about two dozen large metro areas), these beacons do not need to be closely monitored as these flights are threatening no one. A corollary is we do not need to store data on every flight where airspace utilization is very low. This method automatically filters out flights in low use areas.
3. If law enforcement needs to collect data, consistent with COPPA, they can set up their own Beacon ID receivers at special events, such as a game at a stadium, or a public parade, or other areas where they are concerned about security. These receivers could collect and store the remote ID information including the operator information under the “one time use” exemption of COPPA.
4. Airports could set up Beacon ID receivers if concerned about illegal flights close to the airport. Such receiving systems could readily pick up beacons from miles away from drones flying at higher altitudes of 100′, 200′ or more – the only drones we need to care about. High gain antennas would readily receive transmissions at great distances. I previously worked for Vivato Wireless where we built smart antenna panels that provided high speed Internet connections to notebook computers with standard, low powered, internal Wi-Fi – located miles away.
5. A Beacon ID receiver would be identical to the units on board Part 107 drones that receive beacon IDs and relay into the Internet. Since such units would be mass produced,  costs for a law enforcement or airport receiver would be affordable.

In addition to using airport located Beacon ID receivers, the existing LAANC system may be used to receive authorization and logging of flight operations.

This proposed solution resolves:

• the COPPA conflict,
• Eliminates 4th Amendment privacy issues regarding the government logging flights inside private homes or personal properties (side effect of flying compliant Remote ID craft sending position reports from inside homes)
• Continues to provide information for air traffic management services, where the traffic load demands data collection
  
• Puts the burden of cost on the specific air space users that benefit from air traffic management services
• Dramatically lowers costs and simplifies operations for recreational users
• Cost reduction and simplification increases the likelihood of compliance (this is very important)
• Continues to utilize beacon Remote ID so that all craft owners can be identified in flight by law enforcement
• Enables direct monitoring and logging via local Beacon ID receivers installed, as needed, at airports or by law enforcement at special events
• Removes the complexity and difficulty of Internet access requirement in numerous and large areas that have no viable Internet access available.
• Because Part 107 prohibits operations by those under 13 (rather 16) by virtue of the Part 107 age requirement, this eliminates the likelihood of the REMOTE ID USS collecting data on protected youth.
• Since the Beacon ID is a simple transmission using U.S. Part 15 frequencies that are also typically available for unlicensed devices internationally, this leads to a potential global standard solution. Persons traveling into the U.S. could then bring their own craft and apply for a temporary registration for flight inside the U.S. Similarly, if adopted internationally, U.S. travelers could take their drones to other countries that require Remote ID. Indeed, it could be that registration databases of such countries are shared between countries – and there would be no need for travelers to register in each country they visit.
• Several vendors have demonstrated workable, low cost, light weight, small beacon transponder technology using commonly available Wi-Fi and Bluetooth 5 technology.  BT 5 based options could even be added to existing model aircraft, which would enhance the air space system without limiting flights of existing small UAS and homebuilt models to FRIA reservations – or the trashing of investments in existing small UAS when the rule takes effect.
• Note – presumably anyone could receive these Beacon-based Remote ID transmissions and anyone could choose to store them in a database. And doing so would subject them to COPPA. However, this is their problem – not the FAA’s problem as the FAA and their Remote ID USS contractors are not the one’s storing the data  [Added late on January 13, 2020]

This would require either a change to the Limited Remote ID standard such that it would utilize beacon-based reporting only, thus simplifying such craft and their operation, and likely lowering costs of such craft, which could encourage the purchase of new and compliant small UAS with beacon-based Remote ID. Or defining another standard perhaps called Beacon ID – simple, inexpensive, and potentially compatible with the EU standard for drone remote identification.

Comments please?

Footnote

[1]  Added on January 16, 2020. As noted, where air traffic is light, we do not need to collect all recreational flight tracks for air traffic management, which only serves the needs of automated drone fleet operations – which are not then using the air space!

There is a reverse problem too – suppose there are many recreational flyers and many drone operations all sharing the same space – sort of a worst case scenario. Would this result in, say, half a dozen automated drones each relaying the same remote ID packets? Yes, this  could generate duplicates. There are ways to minimize duplicates, however. See the Automatic Position Reporting System (APRS) (also known as Amateur Packet Reporting System) which has been used for position reporting by ham radio operators for over 30 years. There are additional issues related to the Part 15 noise floor, the requirement to send packets once per second in a shared wireless environment, and the “hidden transmitter” problem.

Software designers often think of all wireless links as being just like wired connections – but in the ether. In the real world, wireless has it own set of unique characteristics and you do not want to waste the bandwidth with excessive transmissions – once per second will quickly become excessive with n users where n is large. The system collapses. There are ways to minimize position reports (see the design of the Automatic Position Reporting System/Amateur Packet Reporting System/APRS for ways of reducing the number of position reports sent. For this reason, the NPRM should not specify a once per second rate – as there are scenarios where this “hard coded” value can result in network collapse.