See  RID – Somebody’s Watching Me?

By Dawn M. K. Zoldi, (Colonel, USAF, Retired), attorney and expert on UAS law.

She identifies many of the issues I previously described including the failure of the FAA to meet the requirements of the Childrens Online Privacy Protection Act – and proposes a solution with some similarities to my proposal.

She discusses data retention issues (a topic I have in my notes but have not had time to write about on this blog), and privacy issues including the 4th amendment.

Please also read the updated (January 12th and 14th) post about how the NPRM de facto eliminates most indoor flight of small UAS as Remote ID prevents flying if there is no GPS signal and the FAA asserts in the NPRM that only Remote ID compliant UAS may be sold.

Short Summary

• Where Internet access is available, most flights of small UAS must be recorded, in real time, in an Internet database called a REMOTE ID USS.
• Separately, there is a Federal law named Childrens Online Privacy Protection Act (COPPA) that restricts the collection of data on children under age 13 (there is a bill in in Congress to raise that to under 16). This bill specifically includes geolocation data, and data collected from “toys and Internet of Things” devices as protected information on youth.
• These restrictions apply to businesses, government and government contractors. There is no exemption for the FAA.
• Even if they do not know they are collecting data on children, if a parent or guardian finds out after a flight that data has been collected, the parent has a legal right to request to review the data, request to delete the data and request to suspend further collection of the data. The FAA has no choice. Age restrictions on flight do not solve the problem as kids will still fly anyway and once notified, the REMOTE ID USS has to comply with COPPA.
• We end up with, then, the FAA mandating collection of geolocation data on children while simultaneously another law, COPPA, says they cannot do that. Both cannot be true simultaneously.
• This is a serious problem for the FAA’s NPRM and there are no obvious solutions within their current proposal. I propose a novel solution to eliminate most of the problems with Remote ID logging and COPPA and simplify the ease of compliance and costs for recreational flyers.

Background on COPPA

The FAA’s NPRM for remote ID of all small UAS includes a provision that where Internet access is available, all craft (except those < 0.55 pounds) must subscribe to and log their flight in real time, once per second, into an Internet database called a REMOTE ID USS.

I was tipped off by someone  in the legal field who says the mandatory collection of real time flight data – including of flights conducted by children – appears to conflict with a Federal law known as the Childrens Online Privacy Protection Act which restricts the collection of data on children under age 13. This law applies  to businesses, the Federal government and any contractors they use – there is no exemption for the government to collect data on children. It specifically restricts the collection of geolocation data and data provided by “toys and Internet of Things” connected devices.  Yet the FAA plans for an Internet-connected database tracking all flights, including by children, in an Internet database known as a REMOTE ID USS.

(My background is engineering, not law. However, when designing products or services, if I see possible legal issues, I document them and ask for legal assistance. This post is seeking feedback on these issues and my proposed technical solution .)

If a parent or guardian becomes aware that information has been collected about their child, including geolocation data, the parent or guardian is legally entitled to let the service know  – in this case, the REMOTE ID USS. Once notified, the parent is legally entitled to request to review the data, to request suspension of data collection and to request deletion of all collected data. (In effect, essentially anyone could spoof these requests and ask for deletion of data.)

The FAA could, say, ban flights by kids under 13 (Congress is considering raise the age to under 16) but that does not solve this problem. A child could take Mom’s quadcopter out to  the backyard and fly it. Once Mom discovers this, COPPA protections kick in – and she can request review, suspension or deletion of the data afterwards.

The FAA knew this in 2015 when they issued  a report on  registering all pilots of remote UAS. In that report, they stated they would not allow anyone under age 13 to register as they would then have to deal with COPPA, but they noted that children under 13 could still fly under the supervision of an adult who has registered.

What has changed is that under the Remote ID NPRM, the FAA would now be logging all flights by children, which runs into difficulties with COPPA requirements.

(I have pages of supporting quotes from the Federal Trade Commission that describe COPPA in details, and extensive notes on how this relates to the NPRM. The above is only a brief summary of the COPPA issues. This is a real problem for the NPRM.)

I could not identify a workable solution to the “COPPA dilemma” of the FAA logging a child’s geolocation data in real time without coming up with an alternative way of tracking aircraft.

This is the proposed concept I came up with to solve this problem and I am seeking feedback on this idea.

Proposed Technical Solution to the COPPA Restrictions on Data Collection

Continue reading Feeback sought: Draft of a concept to resolve FAA Remote ID conflicts with COPPA Law →

(Posted originally mid day on January 10th. Received feedback on social media and made several important edits late on the 10th. Then, made additional minor edits  January 12th to clarify some items, based on additional feedback. Notably have changed “ban”/”banned” to “eliminates” as a more accurate description of what happens to indoor flight when no commercially made, non-complaint aircraft are available. IF you read this before January 12th, there are important changes and clarifications.

As of January 14th, an FAA official acknowledges the FAA cannot regulate indoor airspace – but has not provided a specific solution to the restrictions imposed by only permitting the sale of compliant  aircraft that require GPS to fly.)

The FAA’s Notice of Proposed Rulemaking concerning standards for use of Remote Identification on small unmanned aircraft has the side effect of eliminating [4]  nearly all indoor flight of compliant, commercially made and sold model aircraft (greater than 0.55 pounds).

This is because compliant aircraft cannot fly unless they have a GPS signal and most indoor locations will lack a GPS signal.

In an email to me on January 9th, the FAA’s Office of Rulemaking confirmed this is the case. On the 14th, an FAA official acknowledges they cannot regulate indoor airspace but has not offered a solution to the “can’t fly if no GPS signal” issue for all commercially built and sold small UAS.

How this occurs

• The NPRM requires only certified remote ID capable craft are sold in the U.S. 2 years after the rule takes effect[1]. All new small UAS must have Remote ID.
• Remote ID requires periodic transmission of the craft and/or operator’s latitude and longitude.
• The latitude and longitude are obtained from GPS signals.
• If no GPS signal is presence,  the Remote ID system automatically prevents the small UAS from taking flight.
• Since GPS is not available in most indoor areas, this eliminates the operation of commercially made small model aircraft inside most buildings. This includes private homes, garages, shops, businesses,  warehouses, manufacturing plants, convention centers, exhibit halls, mines and caves and other interior locations.
• The FAA intends to restrict the manufacturing and sale of small UAS to certified, compliant aircraft only, meaning Remote ID and GPS functional.  On page 16 of the NPRM, the FAA writes: “The FAA envisions that upon full implementation of this rule, no unmanned aircraft weighing more than 0.55 pounds will be commercially available that is not either a standard remote identification UAS or a limited remote identification UAS.” [2]
• Only compliant aircraft could be sold as new, 2 years after the rule takes effect.
• The FAA is indirectly regulating the use of indoor airspace by prohibiting the sale of non-compliant aircraft that could function indoors[3].The FAA has no legal jurisdiction to regulate indoor airspace and they have acknowledged this.
• (January 14th update) On page 8 of the NPRM, the FAA writes“All UAS produced for operation in the airspace of the United States would have to comply with the design and production requirements established in this proposal with exceptions for amateur-built UAS, UAS of the United States government, and unmanned aircraft that weigh less than 0.55 pounds.”The bold face text implies the FAA will permit the sale of small UAS that have a label on the side saying “For indoor flight only”. And this will prevent their outdoor use, how?Essentially, we are back to a conventional regulatory system that is based on trust and enforcement, rather than software mandated control.

A method to obtain reliable, tamper proof latitude and longitude without  GPS and inside buildings has not been identified, and if such technology exists, could it work on small UAS?

Problem Summary

• The FAA intends that only certified, compliant commercially built may be sold in the US.
• Compliant UAS require functioning GPS to fly; if no GPS,  they cannot fly, which means any commercially sold small UAS will not fly in most indoor locations.
• The FAA acknowledges it cannot regulate indoor airspace but has not resolved the conflict between the rules that prohibit sale of non-compliant small UAS and the lack of GPS signal indoors which de facto regulates access to indoor airspace.
• The note on page 8 implies someone may sell a craft with a “For indoor use only” sticker on the side, which largely defeats the purpose of most of the NPRM requiring remote ID on all outdoor flights. Surely, no one will ever fly a drone with a “For indoor use only” sticker outside?

Please read the email from the FAA Office of Rulemaking below. If you read this before January 12th, or the 14th, and are revisiting, please see footnotes [1] through [5] to understand what changed since this was originally posted. Continue reading #FAA confirms that #RemoteID #NPRM Eliminates Most Indoor Flight #UAS #UAV #modelaircraft #Quadcopters →