The Explosive Drone Threat
Executive Summary
Weaponised commercial drones have crossed from military theatre into the critical infrastructure threat environment. The strikes in Moscow (July 2023), Lublin (November 2024), and Chernobyl (February 2025) demonstrate that commercial platforms modified to carry explosive payloads of 5-30 kg TNT equivalent can achieve sub-2 metre circular error probable at operationally relevant ranges — sufficient to engage specific aim points on unprotected infrastructure from beyond perimeter fence lines.
This paper presents the complete technical analysis of the explosive drone threat against CNI: platform taxonomy and payload characterisation, structural impact methodology using validated pressure-impulse relationships, probabilistic risk assessment with full methodology transparency, the detection technology architecture, and the passive and active countermeasure hierarchy. The probability assertions in this paper are derived using a structured elicitation methodology based on published incident frequency data, capability trend analysis, and barrier assessment — not modelled projections without basis.
The detection section — new in this edition — addresses the specific technical challenge that makes explosive drone detection harder than perimeter intrusion detection: a drone approaching at 15 m/s from 500 m altitude leaves a decision window of approximately 33 seconds from detection to impact. That window, not the detection technology, is the binding constraint on counter-UAS architecture design.
1. Platform Taxonomy — What Is Actually Being Used
The explosive drone threat against CNI is not a single homogeneous capability — it spans a range of platforms with different payload capacities, ranges, guidance systems, and operational signatures. Understanding the specific platform classes that have been used in confirmed CNI-relevant attacks is prerequisite to calibrating the structural impact analysis and the detection architecture.
1.1 Platform Classes — Confirmed CNI-Relevant Deployments
Fixed-wing loitering munitions — Shahed-136 class. Iranian-designed, Russian-deployed in Ukraine from September 2022. Wingspan approximately 2.5 m, length 3.5 m, payload 40-50 kg shaped charge warhead, range 2,000+ km, cruise speed 185 km/h. Guidance: inertial navigation with GPS correction, terminal guidance via pre-programmed waypoint. RCS (radar cross-section) approximately 0.01-0.05 m² — below the detection threshold of many conventional air surveillance radars at low altitude. October 2022 Kyiv infrastructure strikes used Shahed-136 against energy infrastructure simultaneously with 84 cruise missiles — the first confirmed synchronised kinetic-cyber-UAS attack. Not commercially available but the design has been replicated by non-state actors using commercial off-the-shelf components.
Commercial quadcopter — modified DJI Matrice/Phantom class. Commercial platforms modified with electromagnetic latch release mechanisms, servo-activated cargo hooks, or timed drop mechanisms. DJI Matrice 300 RTK: payload capacity 2.7 kg, range 15 km, flight time 55 minutes with standard battery. Modified for payload delivery: electromagnetic latch systems available from commercial UAV accessory suppliers for under EUR 80, mounting a 2-3 kg shaped charge or fragmentation device. CEP at 50 m altitude over a static target: approximately 0.5-2 m based on forensic data from Eastern European seizures. DJI AeroScope and DJI FlightHub transmit operator location data via Remote ID — but modified or firmware-patched platforms can defeat this.
Fixed-wing FPV — First-Person View attack drones. Purpose-modified fixed-wing or hybrid VTOL platforms with FPV guidance providing real-time video feed to the operator for terminal guidance. First-Person View eliminates GPS dependency for terminal guidance — the operator steers to the aim point visually. CEP for FPV-guided terminal phase: approximately 0.3-1.0 m against a static target at ranges up to 5 km. Payload capacity typically 1-5 kg. Cost of platform and components: EUR 500-3,000. Used extensively in Ukraine for precision strikes against vehicle and equipment aim points from 2023 onwards. Directly applicable to CNI infrastructure aim points at comparable ranges.
Heavy-lift commercial platforms — Matrice 600, T40 class. Commercial agricultural and industrial platforms with payload capacities of 6-20 kg. DJI Matrice 600 Pro: payload 6 kg, range 5 km. DJI Agras T40: payload 40 kg (liquid spray tank, convertible to solid payload), range 7 km. These platforms are not commonly available at consumer retail but are accessible through commercial UAV distributors. The Russian-manufactured Motylyk platform, reportedly trialled in Donetsk, claims 300 kg payload capacity — this figure requires independent validation and is assessed as aspirational rather than operationally proven at this payload mass, based on available platform imagery and propulsion system analysis.
Forensic data from seized platforms. Forensic analysis of drone platforms seized in Latvia and France (2024-2025) confirmed: widespread use of electromagnetic latch systems and servo-based cargo releases with unit costs below EUR 80; explosive charges increasingly shaped (explosively formed penetrators, EFPs) or fragmentation-enhanced rather than simple TNT blocks; detonation triggered by impact fuze, radio command, or altitude-triggered barometric fuze. The shift from simple TNT charges to EFPs is operationally significant — an EFP optimised for the transformer cooling fin aim point penetrates the panel with a focused jet rather than relying on blast overpressure, extending effective standoff range and reducing the charge mass required for effect.
Source: DJI product specifications: DJI Enterprise product documentation, current edition. Shahed-136 analysis: UK Defence Intelligence, Ukraine Defence Intelligence Update, October 2022. Forensic data from seized platforms: Latvian State Security Service (VDD) Annual Report 2024. French SGDSN Drone Security Assessment 2024.
2. Structural Impact Analysis — Validated Methodology
The structural impact assessment for drone-delivered explosive payloads uses the same Kingery-Bulmash blast engineering methodology established in the Badhbh Blast Mitigation paper — hemispherical surface burst or elevated burst geometry depending on detonation height, SDOF structural response analysis, and EN 13541 glazing performance classification. This section addresses the specific geometric and charge-mass parameters relevant to the drone delivery mode.
2.1 Elevated Burst vs Surface Burst — Geometry Matters
Drone-delivered charges detonate at altitudes ranging from ground contact (direct impact fuze) to 5-10 metres above ground level (altitude-triggered fuze for area effect). The detonation height significantly affects the blast loading on ground-level structures:
Direct impact (zero height of burst). Hemispherical surface burst geometry applies. Kingery-Bulmash hemispherical equations give the highest overpressure for a given scaled distance R/W^(1/3) because the ground plane doubles the effective charge mass through Mach reflection. For a 5 kg W_TNT charge at direct impact: Z at 3 m radius = 3/5^(0.333) = 1.76 m/kg^(1/3), Pr approximately 900 kPa. This is the governing case for a contact or near-contact detonation on a transformer cooling panel surface.
Elevated burst at 5-10 m AGL. Air burst geometry applies. The ground reflection creates a Mach stem at some radius from ground zero, but directly below the burst point the incident wave arrives without Mach stem enhancement. For a 5 kg W_TNT charge at 8 m altitude: the surface directly below experiences Z = 8/5^(0.333) = 4.66 m/kg^(1/3), Pr approximately 100 kPa — significantly lower than the direct impact case at 3 m radius. However, the area effect at horizontal distances of 5-15 m from ground zero is enhanced relative to a surface burst at the same horizontal range, because the spherical wave geometry distributes energy over a larger footprint. Elevated burst is preferred for area-effect glazing damage; direct impact is preferred for point-effect structural penetration.
For transformer cooling fin targeting — a point-effect aim — the FPV-guided platform with a direct impact fuze is the operationally preferred configuration. The charge mass required to perforate 2 mm mild steel cooling panels at direct impact is much lower than the charge mass required to achieve the same effect via overpressure at standoff. A 500 g shaped charge in direct contact with a cooling panel will penetrate it regardless of the panel's blast resistance classification. This is why cooling fin screening rated to stop blast overpressure (the design basis for the screens specified in the Substation Physical Hardening paper) must also provide physical standoff — the screen must prevent the drone from reaching physical contact with the cooling panel surface.
2.2 Key Structural Impact Thresholds
6 mm single-pane annealed glazing — failure at approximately 7 kPa at 3 ms positive phase duration. Kingery-Bulmash hemispherical: 5 kg W_TNT produces 7 kPa at approximately Z = 9.5 m/kg^(1/3), equivalent to R = 16 m standoff. Any unprotected single-pane glazing within 16 m of a 5 kg drone charge detonation is destroyed with essentially 100% probability. Secondary glass fragment velocity: 30-80 m/s, lethal at 60+ m. Source: UFC 3-340-02 Figure 2-193.
22 mm multi-layer laminated glazing (EN 13541 ER3) — resists 5 kg W_TNT at 3 m standoff. Experimental blast testing confirms that 22 mm laminated glazing with embedded steel catch-mesh and anti-shatter film maintains structural integrity under the ER3 test protocol (5 kg W_TNT at 3 m, hemispherical surface burst). Failure mode under above-ER3 loading: progressive lamination separation rather than catastrophic fragmentation — the assembly stays in the frame even after the glass layers have cracked. Source: EN 13541:2012 test documentation; Arup blast laboratory experimental results cited in CPNI glazing guidance.
300 mm reinforced concrete (30 MPa, standard mesh) — partial spallation at 10 kg W_TNT at 1.5 m. SDOF analysis using UFC 3-340-02 Table 3-15 transformation factors predicts yield-range mid-span deflection. Rear face spallation predicted at this loading — fragments ejected at 20-50 m/s into the protected space. Mitigation: 12 mm steel anti-spall plate bonded to rear face (validated in US Army ERDC/GSL TR-06-10). Full structural breach (breaching) requires direct contact detonation of approximately 5 kg W_TNT — achievable by a drone with FPV guidance and a shaped charge. Source: UFC 3-340-02 Chapter 3; ERDC/GSL TR-06-10.
Fragment dispersion — 30-45 degree incidence clustering. Forensic analysis of drone-based attacks in Eastern Europe (2024-2025) confirms that fragments from drone-delivered charges concentrate at 30-45 degree incidence angles around structural infill panels and soffit seams — consistent with the geometric relationship between overhead delivery and horizontal surface targets. This empirical distribution matches the theoretical fragment spray pattern for a fragmenting warhead detonated 2-8 m above a horizontal surface. Design implication: overhead exposure zones at structural infill panel edges require fragment-catching mesh or ballistic-grade polymer overlay — the same overhead exposure zones that ground-based perimeter surveys typically do not assess. Source: UK Defence Science and Technology Laboratory (DSTL) UAS Threat Assessment 2024 (restricted distribution, summary available in CPNI UAS guidance 2023).
THE CHERNOBYL PRECEDENT — VERTICAL ENTRY: The February 2025 Chernobyl incident demonstrated that explosive drones can exploit vertical entry pathways — roof apertures, unprotected skylights, exhaust vents, HVAC intakes — to deliver charges inside structural envelopes that are hardened against ground-level threats. ISR drones mapped the facility vulnerability before the attack drone was deployed. This two-phase methodology — reconnaissance drone followed by attack drone — is operationally coherent and requires no ground access to the facility. Roof aperture screening and upward-facing radar coverage are direct design responses to the Chernobyl model.
3. Probabilistic Risk Assessment — Methodology and Basis
The original version of this paper asserted a greater-than-40% probability of multi-site CNI disruption by explosive drone within three years, with a confidence interval of 10-15%. That assertion was analytically unsupported — no methodology was provided, no basis for the specific figures was cited, and the confidence interval format implied a statistical rigour that was not present. This section replaces that assertion with a structured probabilistic risk assessment using a transparent, documented methodology.
3.1 The Problem With Unsupported Probability Assertions
Probability assertions without methodology are not risk assessments — they are rhetorical devices. A security engineering audience will correctly identify the difference between a structured risk assessment and a number inserted for persuasive effect. The original 40% figure had no analytical basis that could be examined, challenged, or updated as the evidence base changes. It therefore had no analytical value and undermined the credibility of the paper as a whole.
The appropriate response is not to remove probability language entirely — likelihood assessment is a legitimate and necessary component of risk analysis. It is to provide the methodology so that the reader can assess whether the analytical basis is sound and can update the estimate as new evidence becomes available.
3.2 Structured Elicitation Methodology — The Framework
The probability framework used here is a structured qualitative-to-quantitative translation based on three evidence streams: incident frequency trend analysis, capability accessibility assessment, and barrier assessment. This approach is consistent with ISO 31000:2018 Clause 6.4 (risk assessment) and the structured expert elicitation methodology described in NUREG/CR-6728 (US Nuclear Regulatory Commission, Technical Basis and Implementation Guidelines for a Technique for Human Event Analysis, 2000 — the structured elicitation methodology developed for nuclear safety analysis has been adapted for security risk assessment in multiple peer-reviewed publications).
The framework produces a qualitative likelihood rating (Very High, High, Moderate, Low, Very Low) that is then translated to a probability range using the standard likelihood-consequence matrix scaling from ISO 31000. It does not produce a precise single-figure probability — such precision is not achievable from the available evidence base without false rigour. The output is an honest assessment of the likelihood category with documented basis.
3.3 Evidence Stream 1 — Incident Frequency Trend Analysis
The following confirmed incidents establish the base rate for explosive drone attacks on infrastructure:
July 2023: Moscow drone strikes on residential and commercial buildings. Multiple commercial-derived platforms modified for explosive payload delivery. Physical damage to buildings confirmed from post-incident imagery.
October 2022 to present: Systematic Shahed-136 and modified commercial drone attacks on Ukrainian electricity generation and transmission infrastructure. Over 1,200 documented strikes on energy infrastructure in Ukraine between October 2022 and December 2024 (UNOCHA Ukraine Energy Infrastructure Damage Assessment, December 2024). This is not a precedent — it is an ongoing operational campaign demonstrating sustained capability against CNI.
November 2024: Lublin, Poland. Explosive drone strikes on commercial and logistics infrastructure. Polish ABW (Internal Security Agency) assessed as Russian hybrid warfare operation. First confirmed explosive drone attack on NATO member territory during the current conflict period.
February 2025: Chernobyl exclusion zone. Explosive drone penetrated facility via unprotected roof exhaust aperture. Two-phase operation — ISR drone preceding attack drone — confirming deliberate target selection methodology.
2023-2024: Surveillance drone overflights of Norwegian offshore energy facilities (confirmed by Equinor); surveillance drone activity above German LNG terminal at Brunsbüttel (confirmed by German BSI). Reconnaissance without kinetic effect — but establishing target pattern-of-life data for potential future strikes.
Trend analysis: the frequency of explosive drone attacks on European infrastructure (broadly defined) has increased from zero in 2020 to multiple confirmed incidents per year by 2024-2025. The trend is monotonically increasing. The base rate is non-zero and accelerating.
Source: UNOCHA. Ukraine Energy Infrastructure Damage Assessment. December 2024. Polish ABW. Annual Report 2024. Summary: drone threat to NATO infrastructure. Norwegian Petroleum Safety Authority. Offshore Drone Security Report 2024. German BSI. Lageberichte zur IT-Sicherheit in Deutschland 2024.
3.4 Evidence Stream 2 — Capability Accessibility Assessment
The capability required to conduct an explosive drone attack on CNI has five components. The accessibility of each component is assessed against documented market and operational evidence:
Platform acquisition. Commercial quadcopters with 2-5 kg payload capacity are available without licence or registration from commercial suppliers in most European jurisdictions. DJI Matrice 300 series: available from commercial UAV distributors, price approximately EUR 5,000-8,000. No specialist knowledge required for operation beyond standard remote pilot certificate (EU Open Category A2, requiring a 40-question online exam). Accessibility: Very High.
Payload release mechanism. Electromagnetic latch and servo release systems are available from commercial UAV accessory suppliers for EUR 60-120. No modification of the airframe required — the release mechanism mounts to the standard payload attachment point. Accessibility: Very High.
Explosive charge — access in Europe. Access to commercial explosives in Europe is controlled by Directive 2014/28/EU (civil explosives) and national firearms and explosives legislation. Legal access requires licensing. However, TATP and HMTD synthesis routes are widely documented on open-source platforms, and precursor chemicals are accessible through retail channels — CISA's 2023 Chemical Facility Anti-Terrorism Standards (CFATS) analysis documented over 200 documented TATP synthesis attempts by non-state actors using commercially available acetone and hydrogen peroxide in the preceding 24 months. The Brussels 2016 attacks used approximately 20 kg TATP per device synthesised from commercially available precursors. Accessibility for motivated non-state actors: Moderate to High.
Navigation and guidance. GPS-guided waypoint navigation is standard on all commercial quadcopters above EUR 500. FPV real-time guidance systems are available for EUR 200-600. Sub-2 metre CEP against a static target using commercial GPS is achievable without modification. Accessibility: Very High.
Target identification and approach routing. CNI infrastructure locations are identified from public planning applications, Google Earth, and utility regulatory filings. Approach routing for a drone — avoiding air traffic corridors, selecting low radar probability approach vectors — requires basic aeronautical chart reading and familiarity with airspace structure. No specialist intelligence access required. Accessibility: High.
Compound accessibility assessment: four of five capability components are Very High or High accessibility. The explosive charge component is Moderate to High for a motivated actor. The compound capability is accessible to any motivated individual or group without specialist state support. This is the Tier 2 threat actor capability profile from the Intelligence Brief framework — it does not require Tier 1 state resources.
3.5 Evidence Stream 3 — Barrier Assessment
The effectiveness of current barriers against explosive drone attack on European CNI is assessed across four barrier categories:
Regulatory barrier. EASA Regulation (EU) 2019/947 requires Remote ID for commercial UAS operations — a broadcast signal identifying the operator and aircraft. Remote ID is enforceable for compliant operators in EU airspace. However: Remote ID can be disabled by firmware modification; enforcement depends on detection of the flight, which requires radar or RF monitoring; and the regulation does not apply to illegally modified or non-compliant platforms. Regulatory barrier effectiveness: Low against motivated state-directed or criminal actors; Moderate against opportunistic non-state actors.
Physical perimeter barrier. Current CNI perimeter security is designed primarily against ground-level threats — vehicle access, pedestrian intrusion. Perimeter fences, barriers, and CCTV systems provide no detection or defeat capability against a drone approaching at 100-500 m altitude. The perimeter is irrelevant to the drone threat vector. Physical barrier effectiveness against drone: effectively zero for most current CNI perimeters.
Detection barrier. Radar, RF detection, acoustic, and electro-optical detection systems capable of detecting small UAS are commercially available and increasingly deployed at high-value CNI sites following CPNI guidance updates. However, their deployment across the general CNI estate in Ireland and Europe is patchy and not mandated by current regulatory frameworks. Detection barrier effectiveness: High at sites with deployed counter-UAS detection systems; effectively zero at sites without them. Across the general European CNI estate: Low to Moderate.
Defeat/interdiction barrier. Active counter-UAS defeat — jamming, kinetic intercept, directed energy — is subject to national legislation in most European jurisdictions. In Ireland, RF jamming is regulated under the Wireless Telegraphy Acts and is not generally authorised for private CNI operators. Kinetic defeat (net launchers, trained raptors, laser systems) requires specific authorisation. In practice, most Irish and European CNI operators have no legal defeat capability against an inbound explosive drone. Defeat barrier effectiveness: effectively zero for most civilian CNI operators without state intervention.
BARRIER ASSESSMENT SUMMARY: The barrier structure against explosive drone attack on European CNI is: regulatory barrier — Low to Moderate; physical perimeter — effectively zero; detection — Low to Moderate (patchy deployment); defeat — effectively zero for civilian operators. The compound barrier effectiveness is Low. A motivated actor with the capability documented in Evidence Stream 2 faces a Low barrier to conducting an explosive drone attack on an unprotected CNI site.
3.6 Probability Assessment — Structured Conclusion
The three evidence streams produce the following structured likelihood assessment for an explosive drone attack causing operational disruption to European CNI (excluding active conflict zones) within a 36-month horizon from the date of this paper (March 2026 to March 2029):
Likelihood category. HIGH. Defined in ISO 31000 scaling as: the event has occurred in comparable contexts (confirmed — Lublin 2024, Chernobyl 2025, Norway/Germany reconnaissance 2023-2024); the capability is accessible to Tier 2 and above actors without specialist state resources (confirmed — Evidence Stream 2); the barriers are assessed as Low compound effectiveness (confirmed — Evidence Stream 3); and the trend is monotonically increasing (confirmed — Evidence Stream 1).
What HIGH likelihood means in quantitative terms. ISO 31000 and equivalent risk matrices (NIST SP 800-30, CPNI risk methodology) translate HIGH likelihood to an indicative probability range of 50-75% occurrence within the defined timeframe and defined scope. The defined scope here — any explosive drone attack on any CNI site in Europe (excluding active conflict zones) in a 36-month window — is broader than a specific attack on a specific Irish site. The probability for a specific individual Irish site in isolation is lower; for the aggregate European CNI estate over 36 months, the HIGH category applies.
Uncertainty and limitations. This assessment is based on open-source evidence. Classified intelligence on adversary intent, capability development, and specific target planning would materially affect the assessment if available. The trend analysis relies on a short incident history (2022-2025) which may not be representative of the longer-term baseline. The capability accessibility assessment may underestimate barriers that are not publicly visible (covert counter-UAS deployments, intelligence service disruption of procurement channels). These limitations support the qualitative HIGH category rather than a precise single-figure probability.
REPLACING THE ORIGINAL ASSERTION: The original paper stated 'greater than 40% probability of multi-site disruption within three years' with a '10-15% confidence interval.' Both elements of that assertion are now removed. The 40% figure had no documented basis. The confidence interval format implied a statistical precision not achievable from the available evidence. The replacement assessment — HIGH likelihood for the aggregate European CNI estate over 36 months, translating to approximately 50-75% probability range per ISO 31000 scaling — is less precise but analytically honest. It can be examined, challenged, and updated as the evidence base changes. The original figure could not be.
4. The 33-Second Problem — Why Detection Architecture Is the Binding Constraint
Drone detection is the operational prerequisite for any active counter-UAS response. But the decision window available between detection and impact determines whether the detection is operationally useful — and for a fast-moving drone on a direct approach, that window is shorter than most counter-UAS system designers acknowledge.
The arithmetic. A commercial quadcopter at maximum speed (DJI Matrice 300: 23 m/s in Sport mode, approximately 82 km/h) on a direct approach from 500 m detection range has a flight time of approximately 22 seconds from detection to impact. A slower loitering approach at 8 m/s (typical for a payload-laden platform): approximately 62 seconds from 500 m. A Shahed-136 class platform at 185 km/h approaching from 2 km radar detection range: approximately 39 seconds. The median across these scenarios is approximately 33-40 seconds. This is the decision window — the time available between detection alert and impact for any response action to be initiated, authorised, and executed.
THE 33-SECOND PROBLEM: 33-40 seconds is insufficient for: human decision-making and authorisation of a kinetic response (typical military shoot/no-shoot decision cycle: 60-180 seconds); law enforcement dispatch and response (minimum several minutes); manual activation of any system that requires a human operator to identify, assess, and respond. What 33-40 seconds is sufficient for: automated alert transmission to a monitoring centre; automated activation of pre-configured protective measures (door hardening, personnel shelter-in-place alert, automated jamming where legally authorised); and transmission of location data to a pre-alerted response force already staged at the site. The 33-second problem does not mean detection is useless — it means that detection must be coupled to automated response pre-configuration, not to a human decision chain.
4.1 Detection Technology Matrix
RF Detection — Remote ID and Non-Cooperative Signals
Mechanism. RF detection systems monitor the radio frequency spectrum for drone communication signals — the 2.4 GHz and 5.8 GHz control links used by commercial platforms, the Remote ID broadcast required by EASA Regulation (EU) 2019/947, and the video downlink frequencies used by FPV platforms. Detection range for a standard DJI platform in normal operation: 500 m to 2 km depending on antenna configuration, terrain, and RF environment.
Limitations. RF detection is effective against compliant platforms transmitting on standard frequencies. It is degraded or defeated by: encrypted or frequency-hopped control links (available on military-grade platforms and increasingly on modified commercial platforms); autonomous platforms that do not require a continuous control uplink after waypoint programming; platforms operating in dense urban RF environments where interference masks the drone signal. RF detection is a necessary but not sufficient detection layer — it must be combined with at least one non-RF sensor.
Products. Dedrone DroneTracker, D-Fend Solutions EnforceAir, Aaronia AARTOS. All provide classified detection range data in product specifications. CPNI endorses RF detection as a baseline layer for all CNI counter-UAS installations.
Source: Dedrone. DroneTracker Technical Specifications. 2024. CPNI. Counter-UAS Security Technology: An Introduction. 2023 edition.
Radar — Primary Sensor for Non-Cooperative Platforms
Mechanism. Radar provides detection regardless of the drone's RF emissions status — it detects the physical return from the drone's airframe. Small UAS represent a detection challenge because their RCS is 0.001-0.1 m² — comparable to birds, much smaller than aircraft. Specialist micro-Doppler radar can distinguish drones from birds by analysing the Doppler frequency modulation produced by rotating propeller blades — propeller rotation frequency (typically 100-300 Hz for quadcopter propellers) produces a distinctive micro-Doppler signature absent from bird flight.
Key systems and performance. Blighter B400 series: electronically scanned radar, optimised for low-slow-small (LSS) target detection. Detection range for a 0.01 m² RCS target (small quadcopter): approximately 1-3 km depending on atmospheric conditions and clutter environment. Echodyne EchoGuard: MESA (Meta Material Electronically Scanned Array) radar with 120-degree coverage per unit, effective at 1-2 km against quadcopter class targets. Detection latency: typically less than 1 second from target entry into coverage zone to alert generation. Multiple radar units required for 360-degree coverage of a typical substation or data centre perimeter.
Limitations. Radar in dense urban environments is degraded by clutter from buildings, vehicles, and infrastructure. False positive rates from bird activity are significant in rural environments and must be managed by micro-Doppler filtering and sensor fusion. Radar cannot identify the operator location — it provides target track but not attribution. Birds and drones at similar altitudes and speeds can produce similar radar returns in marginal clutter environments.
Source: Blighter Surveillance Systems. B400 Series Technical Data Sheet. 2024. Echodyne. EchoGuard Counter-UAS Radar. Product Specification. 2024.
Acoustic Detection — The Propeller Signature
Mechanism. Quadcopter propellers produce a characteristic acoustic signature with fundamental frequency determined by rotor RPM (typically 60-200 Hz for large platforms, 200-400 Hz for small platforms) and harmonics extending to 2-4 kHz. Acoustic detection systems use microphone arrays to detect this signature against ambient noise, providing bearing-only detection (no range measurement without additional sensors).
Operational parameters. Detection range in quiet rural environment: 300-500 m for a quadcopter class platform. Detection range in urban environment with significant ambient noise: 50-150 m. Detection range for a Shahed-136 class platform (piston engine noise signature): 1-3 km. Acoustic detection is most effective in quiet rural environments — precisely the environments where transmission substations and rural water infrastructure are located. In urban environments it provides a supplementary layer rather than a primary detection capability.
Products. SRC Inc. WHISPER system (military grade); Robin Radar ELVIRA (commercial, specifically designed for drone detection); Squarehead Technology Discovair. All provide acoustic-only detection with bearing output for sensor fusion.
Limitation. Acoustic detection provides no range information — it must be fused with radar or EO/IR to determine distance and generate a targeting solution for response. Wind noise above approximately 15 knots significantly degrades acoustic detection performance.
Electro-Optical and Infrared — The Visual Confirmation Layer
Mechanism. Optical cameras (daylight) and thermal infrared cameras (day and night) provide visual confirmation of a detected target and, where resolution is sufficient, identification of platform type and payload configuration. EO/IR is the only sensor that can confirm whether a detected target is a drone versus a bird, and whether it is carrying a visible payload.
FLIR Triton F-Series — Identification grade thermal at range. The FLIR Triton F-Series (previously recommended in the Casement Aerodrome perimeter security specification) provides cooled MWIR thermal imaging with a 25-300 mm zoom lens. Detection range (human-size target): 10+ km. Recognition range (drone identification): 2-4 km at maximum zoom. Identification range (payload visible): 1-2 km. Slaving the Triton to a radar track allows the camera to slew to the detected target's predicted position and confirm within 2-3 seconds of radar alert — providing identification confirmation within the 33-second decision window.
Axis Q6135-LE PTZ — Daylight optical identification. For daylight operations, the Axis Q6135-LE provides 32× optical zoom with IR illumination for low-light operation. Paired with a thermal sensor for 24/7 identification coverage, the Triton-Axis split architecture provides both the detection sensitivity of cooled MWIR thermal and the identification resolution of high-magnification optical.
Source: FLIR Systems. Triton F-Series Product Overview. 2024. Axis Communications. Q6135-LE Product Data Sheet. 2024.
Sensor Fusion — The Genetec PSIM Integration
Individual sensor layers provide incomplete pictures. RF detection identifies a transmission but not a track. Radar provides a track but not identification. Acoustic provides bearing but not range. EO/IR provides identification but only in the sensor's field of view. Effective counter-UAS detection requires sensor fusion — integrating outputs from multiple sensor types into a single operational picture with automated track correlation and alert generation.
The Genetec Security Centre PSIM platform (referenced in the Casement Aerodrome perimeter security specification) provides the integration layer: radar tracks are correlated with RF detections and acoustic bearings to produce a fused target track; when the fused track crosses a defined alert boundary, the EO/IR camera is automatically slewed to the predicted position for visual confirmation; the integrated alert is transmitted simultaneously to the site security operations centre, the duty officer, and (via pre-configured notification) the relevant national authority. The alert includes: target track, estimated speed and bearing, sensor confidence level, and EO/IR imagery if available. Decision makers receive a structured information package, not raw sensor outputs.
SENSOR FUSION AND THE 33-SECOND WINDOW: A Genetec-integrated counter-UAS detection system with radar as primary sensor, RF as secondary, and EO/IR slaved to the radar track can generate a fused, confirmed alert within 3-5 seconds of target entry into the radar coverage zone. At 500 m detection range and a 15 m/s drone approach speed, this leaves 28-30 seconds of decision window after the confirmed alert. That is sufficient for: automated site alert to all personnel; automated transmission of alert and target track to national authority; and initiation of authorised automated response (where legally pre-configured). It is not sufficient for a human decision chain requiring authorisation before any action is taken — which is why the legal framework for counter-UAS response must be designed in parallel with the technical detection architecture, not after it.
5. Counter-UAS Response — The Legal Constraint and the Available Options
Detection without response capability is an early warning system, not a security system. The response to a detected explosive drone is constrained by national legislation in a way that ground-based physical threats are not — and this legislative constraint is the defining operational limitation of civilian counter-UAS programmes in Ireland and most European jurisdictions.
5.1 The Irish Legislative Constraint
RF jamming — prohibited without specific authorisation. RF jamming — transmitting on the frequencies used by the drone's control link to disrupt the control signal — is the most effective single countermeasure against commercially derived drones. In Ireland, RF jamming is regulated under the Wireless Telegraphy Acts 1926-2015 and is a criminal offence without ComReg authorisation. ComReg does not currently provide a general authorisation for private CNI operators to deploy jamming equipment. State actors (Defence Forces, Garda Síochána) may be authorised for specific deployments under the Communications Regulation Act framework.
Kinetic defeat — limited options. Net-launching systems (SkyFence and equivalent) provide a non-RF defeat option that does not require jamming authorisation. Net launchers deploy a ballistic net from a ground-based launcher that entangles the drone's propellers and brings it to ground. Effective range: 50-100 m for ground-based launchers, 20-50 m for drone-mounted net delivery. This is post-perimeter — the drone must be within 50-100 m of the launcher. For a CNI site where the critical infrastructure is inside the perimeter, a 50-100 m defeat range may be insufficient to prevent the drone from reaching the aim point before engagement.
GPS spoofing — legally complex, technically effective. GPS spoofing transmits a false GPS signal that causes the drone's navigation system to believe it is at a different location, either causing the platform to enter a programmed return-to-home sequence or to deviate from its planned approach. GPS spoofing is regulated differently from jamming in some jurisdictions but remains legally constrained for private operators. It is also ineffective against FPV-guided platforms that do not depend on GPS for terminal guidance
Directed energy — emerging, not commercially deployed. High-energy laser systems capable of defeating a drone at 500-1,000 m range are in military development and limited operational deployment. They require significant power infrastructure, trained operators, and are not currently available for civilian CNI deployment. They represent the medium-term solution to the defeat gap — within the 5-year planning horizon for CNI security investment.
5.2 What Civilian Operators Can Do Today — The Realistic Response Architecture
Given the legislative constraints, the realistic counter-UAS architecture for a civilian CNI operator in Ireland comprises: detection (maximally capable, as specified in Section 4); passive hardening (roof aperture screening, overhead aim point shielding, structural protection of critical components); pre-configured automated alert to the relevant national authority (Defence Forces, Garda Emergency Response); and personnel protection measures (shelter-in-place protocols, personnel clearance from exposed areas on drone alert).
The practical implication of the legislative constraint is that physical hardening of specific aim points — the cooling fin screens, bushing protection, roof aperture closing — is the primary control that a civilian operator can implement unilaterally. Detection tells you a drone is coming. Hardening determines whether the drone achieves its operational objective when it arrives. For the time period before Ireland develops a legal framework for civilian counter-UAS defeat deployment, hardening and detection together represent the complete available toolkit.
LEGISLATIVE GAP — THE ACTION REQUIRED: Ireland does not currently have a coherent legislative framework for civilian CNI operator counter-UAS response. The existing Wireless Telegraphy Acts create a prohibition on jamming that was designed for a different threat environment. The Defence Forces and Garda Síochána have separate and not fully interoperable frameworks for counter-UAS operations. A national counter-UAS doctrine — specifying which agencies have authority for what response actions, how civilian operators integrate with state response, and what equipment civilian operators may deploy — is a prerequisite for operationally effective CNI protection against the drone threat class. This legislative gap is a policy recommendation, not a technical one: it cannot be resolved by security engineering alone.
6. Passive Countermeasures — Engineering Specifications
Passive countermeasures that do not require legal authorisation, real-time human decision-making, or active defeat capability are the first-line engineering response to the explosive drone threat. They address the structural consequence of a successful drone strike — not the detection and defeat of the platform before impact.
6.1 Roof Aperture Screening
The Chernobyl 2025 penetration via an unprotected exhaust aperture establishes that vertical entry pathways are operationally exploited. Every roof aperture at a CNI facility — HVAC intakes, exhaust vents, ventilation louvres, service entry points, roof lighting fixtures — represents a potential drone entry pathway.
Screening specification. Steel mesh screening at all roof apertures: minimum 50 x 50 mm aperture mesh size (prevents entry of standard quadcopter propeller but allows adequate airflow for HVAC function); 4 mm wire diameter stainless steel (corrosion resistant, vandal resistant); mounted on a structural frame welded to the aperture surround. For apertures through which controlled airflow is critical (HVAC intakes): airflow calculation required to confirm that the mesh's open area (approximately 70% for 50 x 50 mm mesh at 4 mm wire) maintains the required volume flow rate. For exhaust apertures: downward-angled louvres with mesh backing — the louvre angle prevents direct vertical drone entry while the mesh prevents FPV-guided lateral approach.
Cost. Roof aperture screening is within standard building maintenance budgets. A typical server room or substation control building with 6-10 roof apertures: EUR 2,000-8,000 including survey, fabrication, and installation. The Chernobyl incident resulted in radiological contamination risk to the exclusion zone — an order-of-magnitude greater consequence than the EUR 5,000 screening cost it preceded.
6.2 Overhead Exposure Zones — Fragment and Blast Screening
Structural areas with overhead exposure — the topside of transformer bays, the roof edges of data centre server halls, the topside of cable trays and busbar connections in open-air switchyards — represent aim points accessible from directly above that ground-level perimeter surveys do not capture. A drone approaching at 100 m altitude on a near-vertical descent can reach these aim points without being screened by any perimeter barrier.
Fragment-catching mesh overhead canopies. Steel mesh canopy structures over critical equipment bays provide fragment and blast attenuation for overhead-delivery payloads. Specification: 50 x 50 mm mesh, 5 mm wire, galvanised steel, mounted on a structural framework at 3-5 m above the protected equipment. Impact energy attenuation for a 2 kg drone with 1 kg payload: the mesh decelerates the drone and disrupts the shaped charge geometry, reducing effectiveness. A 100 kg drone (Matrice 600 loaded) impacting a 5 mm steel mesh at 15 m/s: the mesh will be breached but the trajectory is deflected, reducing the probability of achieving the specific aim point. Mesh canopies are not rated blast barriers — they are a consequence-reduction measure that reduces the probability of achieving a specific precision aim point.
Transformer bay enclosure — the definitive overhead protection. Full bay enclosure provides the highest level of protection against both overhead drone delivery and ground-level standoff rifle attack. A reinforced concrete or steel-framed enclosure over the transformer bay with rated walls and a screened roof eliminates both threat vectors simultaneously. Cost: EUR 80,000-200,000 per transformer bay depending on dimensions and structural specification. Against a EUR 3-8 million transformer with an 18-month replacement lead time, the cost ratio is 2-8%.
7. Conclusion
The explosive drone threat against CNI has moved from the conflict zone to the European security environment. The Lublin 2024 and Chernobyl 2025 incidents confirm that attacks on infrastructure outside active conflict zones are occurring. The Norway and Germany reconnaissance overflights confirm that pre-attack target mapping is underway against European energy infrastructure. The capability is accessible to Tier 2 actors without state resources. The barriers across the European CNI estate are assessed as Low compound effectiveness.
The probability assertion that this paper replaces — greater than 40%, confidence interval 10-15%, no methodology — was analytically unsupported and undermined the paper's credibility with the technical audience it is designed to reach. The replacement assessment — HIGH likelihood for the aggregate European CNI estate over the 36-month horizon from March 2026, translating to approximately 50-75% probability range per ISO 31000 scaling — is less precise but documentably honest. Every element of the basis is stated and can be examined.
The detection architecture in Section 4 is the paper's most operationally actionable new contribution. The 33-second decision window from 500 m radar detection to impact is the binding constraint on counter-UAS architecture design — it determines that detection must be coupled to automated pre-configured response, not to a human decision chain requiring authorisation. The sensor fusion architecture (radar primary, RF secondary, acoustic supplementary, EO/IR identification confirmation, Genetec integration layer) provides a confirmed alert within 3-5 seconds of target entry — leaving 28-30 seconds of structured decision time. That window is sufficient for automated site alert, automated national authority notification, and initiation of any legally pre-configured automated response. It is not sufficient for anything else.
The legislative gap is the unresolved constraint. Detection capability at the leading edge of the available technology is deployable today. Hardening of specific aim points is implementable within existing capital maintenance budgets. Active defeat capability — jamming, kinetic, directed energy — is legally constrained for civilian operators in a way that does not reflect the threat environment they face. Closing that gap is a policy task that security engineering cannot resolve unilaterally.
References and Primary Sources
DJI Enterprise. Matrice 300 RTK and Matrice 600 Pro Product Specifications. DJI. 2024.
EASA. Regulation (EU) 2019/947 on Rules and Procedures for Operation of Unmanned Aircraft. European Union Aviation Safety Agency. 2019.
UNOCHA. Ukraine Energy Infrastructure Damage Assessment. United Nations Office for the Coordination of Humanitarian Affairs. December 2024.
Polish Internal Security Agency (ABW). Annual Report 2024. ABW. Warsaw. 2024.
Norwegian Petroleum Safety Authority. Offshore Drone Security Report 2024. PSA Norway. Stavanger. 2024.
German BSI. Lageberichte zur IT-Sicherheit in Deutschland 2024. Bundesamt fuer Sicherheit in der Informationstechnik. Bonn. 2024.
Latvian State Security Service (VDD). Annual Report 2024. VDD. Riga. 2024.
French SGDSN. Evaluation de la menace drone pour les infrastructures critiques. Secretariat General de la Defense et de la Securite Nationale. 2024.
UK Defence Science and Technology Laboratory (DSTL). UAS Threat Assessment 2024. Summary available in: CPNI. Counter-UAS Security Technology: An Introduction. CPNI. 2023.
Dedrone. DroneTracker Technical Specifications. Dedrone Inc. San Francisco. 2024.
Blighter Surveillance Systems. B400 Series Technical Data Sheet. Blighter. Great Chesterford. 2024.
Echodyne Inc. EchoGuard Counter-UAS Radar Product Specification. Echodyne. Kirkland WA. 2024.
FLIR Systems (Teledyne FLIR). Triton F-Series Thermal Security Camera Product Overview. 2024.
Axis Communications. Q6135-LE PTZ Network Camera Product Data Sheet. 2024.
Genetec Inc. Security Centre PSIM Platform Technical Overview. 2024.
US Nuclear Regulatory Commission. NUREG/CR-6728: Technical Basis and Implementation Guidelines for a Technique for Human Event Analysis (ATHEANA). USNRC. October 2000. [Structured elicitation methodology basis.]
ISO 31000:2018: Risk Management — Guidelines. Clause 6.4 (risk assessment) and likelihood-consequence scaling. International Organisation for Standardisation. Geneva. 2018.
NIST SP 800-30 Rev 1: Guide for Conducting Risk Assessments. NIST. September 2012. [Likelihood category definitions.]
CEN. EN 13541:2012: Glass in Building — Security Glazing — Resistance against Explosion Pressure. CEN. Brussels. 2012.
US Army Corps of Engineers. UFC 3-340-02: Structures to Resist the Effects of Accidental Explosions. 2008.
ASCE. ASCE/SEI 59-11: Blast Protection of Buildings. American Society of Civil Engineers. Reston VA. 2011.
NATO. STANAG 4671: Unmanned Aerial Vehicle Systems Airworthiness Requirements. NATO Standardization Office. 2009.
CISA. Chemical Facility Anti-Terrorism Standards (CFATS) Annual Report 2023. CISA. 2023. [TATP synthesis attempt frequency data.]
US DoE. Large Power Transformers and the U.S. Electric Grid. April 2014. [Replacement cost and lead time data referenced in Section 6.]